Jawn: Quadratic parsing effort in AsyncParser

AsyncParser can be forced to perform On^2 work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start. Impact Denial of service via CPU exhaustion when parsing untrusted JSON. Preconditions: - Application...

ai.eto:rikai_2.12 (>=0.0.3, <=0.1.7), black.door:jose-2.12.8-json-circe-2.12.8_2.12 (0.3.0-m1) +496 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_2.12 (0.14.2)

org.typelevel:jawn-parser2.12 MAVEN version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser2.12 and may be impacted: - ai.eto:rikai2.12 =0.0.3, =0.2.4, =0.3.0, =4.1.0, =4.1.0, =4.1.0, =0.6.0, =0.6.0, =0.6.0, =0.0.1,...

com.github.fsanaulla:chronicler-ahc-io_2.12 (>=0.6.5, <=0.7.0), com.github.fsanaulla:chronicler-ahc-management_2.12 (>=0.6.5, <=0.7.0) +37 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_2.12 (0.14.3)

org.typelevel:jawn-parser2.12 MAVEN version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser2.12 and may be impacted: - com.github.fsanaulla:chronicler-ahc-io2.12 =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5,...

com.github.fsanaulla:chronicler-ahc-io_2.13 (>=0.6.5, <=0.7.0), com.github.fsanaulla:chronicler-ahc-management_2.13 (>=0.6.5, <=0.7.0) +32 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_2.13 (0.14.3)

org.typelevel:jawn-parser2.13 MAVEN version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser2.13 and may be impacted: - com.github.fsanaulla:chronicler-ahc-io2.13 =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5,...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-checkpoint-git_3 (>=0.3.0, <=0.5.7) +1190 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_3 (>=1.1.2, <=1.6.0)

org.typelevel:jawn-parser3 MAVEN version =1.1.2, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.4.0 and more Source cves: CVE-2026-61814 Source advisory: OSV:GHSA-W4CM-GVHJ-CGW6...

com.github.fsanaulla:chronicler-ahc-io_2.12 (>=0.6.5, <=0.7.0), com.github.fsanaulla:chronicler-ahc-management_2.12 (>=0.6.5, <=0.7.0) +37 more potentially affected by CVE-2026-59990 via org.typelevel:jawn-parser_2.12 (0.14.3)

org.typelevel:jawn-parser2.12 MAVEN version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser2.12 and may be impacted: - com.github.fsanaulla:chronicler-ahc-io2.12 =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5,...

black.door:jose-json-circe_2.12 (>=0.4.6, <=0.4.10), black.door:jose-json-ninny_2.12 (>=0.4.1, <=0.4.6) +1206 more potentially affected by CVE-2026-59990 via org.typelevel:jawn-parser_2.12 (>=1.0.0-rc1, <=1.6.0)

org.typelevel:jawn-parser2.12 MAVEN version =1.0.0-rc1, =0.4.6, =0.4.1, =0.0.1-m3, =0.0.1-m15, =0.0.1-m20, =0.0.1-m20, =0.0.1-m20, =0.0.1-m22, =0.0.1-m20, =0.0.1-m20, =0.0.1-m20, =0.0.1-m20, =0.0.1-m20, =0.0.1-m3, =0.0.1-m19 and more Source cves: CVE-2026-59990 Source advisory:...

ai.eto:rikai_2.13 (>=0.0.14, <=0.1.7), at.logic.gapt:gapt-examples_2.13 (2.15.4) +409 more potentially affected by CVE-2026-59990 via org.typelevel:jawn-parser_2.13 (0.14.2)

org.typelevel:jawn-parser2.13 MAVEN version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser2.13 and may be impacted: - ai.eto:rikai2.13 =0.0.14, =0.3.0, =0.2.0, =0.0.1, =6.0.0-m1, =0.3.0, =0.3.0, =0.3.0, =0.4.0 -...

com.anymindgroup:zio-pubsub-serde-circe_native0.5_2.13 (>=0.2.3, <=0.2.11), com.github.j-mie6:parsley-debug-json_native0.5_2.13 (>=0.1.0-m1, <=0.1.0-m3) +55 more potentially affected by CVE-2026-59990 via org.typelevel:jawn-parser_native0.5_2.13 (1.6.0)

org.typelevel:jawn-parsernative0.52.13 MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parsernative0.52.13 and may be impacted: - com.anymindgroup:zio-pubsub-serde-circenative0.52.13 =0.2.3, =0.1.0-m1, =10.0.4,...

ba.sake:sharaf-core_native0.5_3 (>=0.10.0, <=0.20.0), ba.sake:sharaf-helidon_native0.5_3 (0.11.0) +93 more potentially affected by CVE-2026-59990 via org.typelevel:jawn-parser_native0.5_3 (1.6.0)

org.typelevel:jawn-parsernative0.53 MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parsernative0.53 and may be impacted: - ba.sake:sharaf-corenative0.53 =0.10.0, =0.18.0, =0.11.1, =0.30.0, =0.12.0, =0.2.3,...

ba.sake:hepek-components_sjs1_3 (>=0.11.1, <=0.34.0), ba.sake:tupson-js_sjs1_3 (>=v0.1.1-dirtyfb94c54e, <=0.1.3) +119 more potentially affected by CVE-2026-59990 via org.typelevel:jawn-parser_sjs1_3 (>=1.2.0, <=1.6.0)

org.typelevel:jawn-parsersjs13 MAVEN version =1.2.0, =0.11.1, =v0.1.1-dirtyfb94c54e, =0.30.0, =0.1.4, =0.0-a75a626, =0.1-a1cba99, =0.1-a1cba99, =0.1-a1cba99, =1.0-148-8da8898, =0.17.0, =0.19.13 and more Source cves: CVE-2026-59990 Source advisory: MEND:CVE-2026-59990...

ba.sake:hepek-components_sjs1_3 (>=0.11.1, <=0.34.0), ba.sake:tupson-js_sjs1_3 (>=v0.1.1-dirtyfb94c54e, <=0.1.3) +119 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_sjs1_3 (>=1.2.0, <=1.6.0)

org.typelevel:jawn-parsersjs13 MAVEN version =1.2.0, =0.11.1, =v0.1.1-dirtyfb94c54e, =0.30.0, =0.1.4, =0.0-a75a626, =0.1-a1cba99, =0.1-a1cba99, =0.1-a1cba99, =1.0-148-8da8898, =0.17.0, =0.19.13 and more Source cves: CVE-2026-61814 Source advisory: MEND:CVE-2026-61814...

com.github.j-mie6:parsley-debug-json_native0.5_2.12 (>=0.1.0-m1, <=0.1.0-m3), com.github.jwt-scala:jwt-circe_native0.5_2.12 (>=10.0.4, <=11.0.4) +29 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_native0.5_2.12 (1.6.0)

org.typelevel:jawn-parsernative0.52.12 MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parsernative0.52.12 and may be impacted: - com.github.j-mie6:parsley-debug-jsonnative0.52.12 =0.1.0-m1, =10.0.4, =4.3.2,...

com.anymindgroup:zio-pubsub-serde-circe_native0.5_2.13 (>=0.2.3, <=0.2.11), com.github.j-mie6:parsley-debug-json_native0.5_2.13 (>=0.1.0-m1, <=0.1.0-m3) +55 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_native0.5_2.13 (1.6.0)

org.typelevel:jawn-parsernative0.52.13 MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parsernative0.52.13 and may be impacted: - com.anymindgroup:zio-pubsub-serde-circenative0.52.13 =0.2.3, =0.1.0-m1, =10.0.4,...

com.47deg:energy-monitor-persistence-app_sjs1_2.13 (0.2.0), com.47deg:energy-monitor-persistence-core_sjs1_2.13 (0.2.0) +81 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_sjs1_2.13 (>=1.2.0, <=1.6.0)

org.typelevel:jawn-parsersjs12.13 MAVEN version =1.2.0, =0.0-a75a626, =0.1-0b4f7b6, =1.0-148-8da8898, =1.16.0-rc7, =0.17.0, =0.0.0-3-cca5341b, =0.1.0, =0.3.2, =9.4.0, =12.0.0 and more Source cves: CVE-2026-61814 Source advisory: MEND:CVE-2026-61814...

Linux Distros Unpatched Vulnerability : CVE-2022-21653

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are...

org.typelevel:jawn-ast_0.27 (1.0.0), org.typelevel:jawn-util_0.27 (1.0.0) potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_0.27 (1.0.0)

org.typelevel:jawn-parser0.27 MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser0.27 and may be impacted: - org.typelevel:jawn-ast0.27 1.0.0 - org.typelevel:jawn-util0.27 1.0.0 Source cves: CVE-2022-21653 Sour...

org.typelevel:jawn-ast_0.27 (1.0.1), org.typelevel:jawn-json4s_0.27 (1.0.1) +3 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_0.27 (1.0.1)

org.typelevel:jawn-parser0.27 MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser0.27 and may be impacted: - org.typelevel:jawn-ast0.27 1.0.1 - org.typelevel:jawn-json4s0.27 1.0.1 - org.typelevel:jawn-play0.27...

com.github.fsanaulla:chronicler-ahc-io_2.13 (>=0.6.5, <=0.7.0), com.github.fsanaulla:chronicler-ahc-management_2.13 (>=0.6.5, <=0.7.0) +32 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.13 (0.14.3)

org.typelevel:jawn-parser2.13 MAVEN version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser2.13 and may be impacted: - com.github.fsanaulla:chronicler-ahc-io2.13 =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5,...

au.id.tmm.fetch:fetch-aws-dynamodb_3 (>=0.7.0, <=0.9.2), au.id.tmm.fetch:fetch-aws-textract_3 (>=0.2.0, <=0.9.2) +338 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_3 (>=1.1.2, <=1.3.1)

org.typelevel:jawn-parser3 MAVEN version =1.1.2, =0.7.0, =0.2.0, =0.7.0, =0.2.0, =0.2.0, =0.29.0, =0.0.1, =0.0.1, =0.0-a75a626, =0.0-a75a626, =0.0-a75a626, =0.1-7d4b1e7 and more Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...