org.typelevel:jawn-ast_0.27 (1.0.1), org.typelevel:jawn-json4s_0.27 (1.0.1) +3 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_0.27 (1.0.1)

org.typelevel:jawn-parser0.27 MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser0.27 and may be impacted: - org.typelevel:jawn-ast0.27 1.0.1 - org.typelevel:jawn-json4s0.27 1.0.1 - org.typelevel:jawn-play0.27...

org.typelevel:jawn-ast_0.27 (1.0.2), org.typelevel:jawn-json4s_0.27 (1.0.2) +3 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_0.27 (1.0.2)

org.typelevel:jawn-parser0.27 MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser0.27 and may be impacted: - org.typelevel:jawn-ast0.27 1.0.2 - org.typelevel:jawn-json4s0.27 1.0.2 - org.typelevel:jawn-play0.27...

org.typelevel:jawn-ast_2.11 (>=1.0.0-rc1, <=1.0.0-rc2), org.typelevel:jawn-json4s_2.11 (>=1.0.0-rc1, <=1.0.0-rc2) +3 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.11 (>=1.0.0-rc1, <=1.0.0-rc2)

org.typelevel:jawn-parser2.11 MAVEN version =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc2 Source cves: CVE-2022-21653 Source advisory: GHSA-VC89-HCCF-RQ55...

Hash collision in typelevel jawn

Impact Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library: Affected implementations include: org.http...