HIGH 7.5 Maven

Jawn: Quadratic parsing effort in AsyncParser

GHSA-w4cm-gvhj-cgw6 · CVE-2026-61814

Published · Modified

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Description

AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.

Impact

Denial of service via CPU exhaustion when parsing untrusted JSON.

Preconditions:

  • Application uses AsyncParser
  • Attacker can send large tokens with control over chunk sizes.

Patches

Fixed in jawn-parser-1.7.0.

Workarounds

If you can't upgrade immediately:

  • Use the synchronous Parser.
  • Buffer incoming bytes into larger chunks before calling absorb

Ready to move

Start Securing

Free, no credit card | First findings in minutes