Jawn: Uncontrolled nesting depth in JSON parser
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| http4s | jawn | before 1.7.0 | 1.7.0 | Patch available | CNA |
| — | org.typelevel:jawn-parser_2.12 (Maven) | before 1.7.0 | 1.7.0 | Patch available | GHSA-cc4v-rvgp-2pf3 |
| — | org.typelevel:jawn-parser_2.13 (Maven) | before 1.7.0 | 1.7.0 | Patch available | GHSA-cc4v-rvgp-2pf3 |
| — | org.typelevel:jawn-parser_3 (Maven) | before 1.7.0 | 1.7.0 | Patch available | GHSA-cc4v-rvgp-2pf3 |
- jawn Vendorhttp4s Affected before 1.7.0 Fixed in 1.7.0 Patch available CNA
- org.typelevel:jawn-parser_2.12 (Maven) Vendor— Affected before 1.7.0 Fixed in 1.7.0 Patch available GHSA-cc4v-rvgp-2pf3
- org.typelevel:jawn-parser_2.13 (Maven) Vendor— Affected before 1.7.0 Fixed in 1.7.0 Patch available GHSA-cc4v-rvgp-2pf3
- org.typelevel:jawn-parser_3 (Maven) Vendor— Affected before 1.7.0 Fixed in 1.7.0 Patch available GHSA-cc4v-rvgp-2pf3
Remediation
- Fix · CNA jawn (typelevel) Fixed in 1.7.0
- Fix · GHSA-cc4v-rvgp-2pf3 org.typelevel:jawn-parser_2.12 (Maven) Fixed in 1.7.0 Advisory →
- Fix · GHSA-cc4v-rvgp-2pf3 org.typelevel:jawn-parser_2.13 (Maven) Fixed in 1.7.0 Advisory →
- Fix · GHSA-cc4v-rvgp-2pf3 org.typelevel:jawn-parser_3 (Maven) Fixed in 1.7.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-59990
- 2026-10-03 Alias added: GHSA-cc4v-rvgp-2pf3
References
Other 7
- https://github.com/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3
- https://github.com/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04
- https://github.com/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed
- https://github.com/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b
- https://github.com/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214
- https://github.com/typelevel/jawn/releases/tag/v1.7.0
- https://github.com/typelevel/jawn
More http4s vulnerabilities
- TI-2022-13223 mTLS client verification is skipped in fs2 on Node.js CVSS 3.1CRITICAL 9.8
- TI-2023-08714 Http4s has fatal error parsing User-Agent and Server headers CVSS 3.1HIGH 7.5
- TI-2022-06031 Hash collision in typelevel jawn CVSS 3.1HIGH 7.5
- TI-2025-37261 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section CVSS 4.0MEDIUM 6.3
- TI-2026-44185 http4s-scala-xml has an XML External Entity (XXE) processing issue CVSS 3.1CRITICAL 9.3
- TI-2020-04336 Local file inclusion vulnerability in http4s CVSS 3.1HIGH 7.6
Sources
- CVE-2026-59990 · CVE Program
- CVE-2026-59990 · NVD
- FIRST EPSS
- GHSA-cc4v-rvgp-2pf3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences