CVE-2026-59990

Katalog CVE

CVSS 7.5 · High EPSS 0,62%

Kerentanan Allocation of Resources Without Limits or Throttling. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.

Rincian

Terbit di NVD

23 September 2026

Terakhir diubah

30 September 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04
• https://github.com/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed
• https://github.com/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b
• https://github.com/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214
• https://github.com/typelevel/jawn/releases/tag/v1.7.0
• https://github.com/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3