CVE-2026-61814 in Jawn
Summary
by MITRE • 09/23/2026
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified involves a critical algorithmic inefficiency within Jawn, an open-source high-performance JSON parser for Scala, specifically affecting the AsyncParser component prior to version 1.7.0. The core technical flaw stems from how the parser handles incremental input streams where individual JSON tokens are fragmented across multiple small data chunks. In this scenario, each invocation of the absorb method triggers a rescanning process that restarts parsing logic from the beginning of the incomplete token rather than maintaining state or continuing from the last known position within that specific token boundary. This design choice results in quadratic time complexity relative to the number of chunks received for a single logical JSON element, as the parser repeatedly re-processes data it has already analyzed up to the current point of fragmentation.
From an operational perspective, this behavior creates a significant resource exhaustion vector that can be exploited by remote attackers controlling untrusted JSON input and dictating chunk sizes. By deliberately sending large JSON values split into numerous tiny fragments, an attacker can force the application consuming Jawn's AsyncParser to perform excessive computational work proportional to the square of the number of chunks. This leads to severe CPU consumption spikes, effectively causing a denial of service condition where legitimate requests are starved of resources or the application becomes unresponsive due to processing bottlenecks. The impact is particularly acute in high-throughput environments such as API gateways, message brokers, or web services that parse large JSON payloads from external sources without strict size limits on individual chunks.
This vulnerability aligns with CWE-400, which classifies issues related to uncontrolled resource consumption, and specifically reflects the pattern of inefficient algorithmic complexity often seen in parsing logic failures. In terms of offensive security frameworks, this exploit technique maps to ATT&CK T1496, Resource Hijacking, where adversaries leverage computational inefficiencies to degrade system performance or availability rather than directly compromising confidentiality or integrity. The attack does not require authentication and relies solely on the ability to send malformedly chunked JSON data to a vulnerable endpoint that utilizes Jawn for deserialization tasks.
Mitigation strategies primarily involve upgrading the Jawn library to version 1.7.0 or later, where the AsyncParser implementation has been optimized to avoid redundant rescanning of incomplete tokens across chunk boundaries. For organizations unable to immediately patch their dependencies, defensive coding practices should be implemented at the application layer. These include enforcing strict limits on maximum JSON payload sizes and implementing rate limiting for incoming requests that contain large or highly fragmented data structures. Additionally, input validation mechanisms can be deployed to detect anomalous patterns of small-chunk transmission indicative of this specific denial-of-service attack vector before they reach the parsing engine.