# CVE-2022-21653: Hash collision in typelevel jawn

Source: https://junglewise.ai/threats/cve-2022-21653-hash-collision-in-typelevel-jawn  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-06  
License: CC BY 4.0 with a link back

CVE-2022-21653 · Severity: low · CVSS 3.1 · Published 2022-01-06

Hash collision in typelevel jawn

Technologies: [org.typelevel:jawn-parser_2.12 (Maven)](https://junglewise.ai/threats/technologies/org-typelevel-jawn-parser-2-12), [org.typelevel:jawn-parser_2.13 (Maven)](https://junglewise.ai/threats/technologies/org-typelevel-jawn-parser-2-13), [org.typelevel:jawn-parser_3 (Maven)](https://junglewise.ai/threats/technologies/org-typelevel-jawn-parser-3). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2022-21653 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-21653 being exploited in the wild.

**How severe is CVE-2022-21653?** Low severity, with a CVSS score of 3.1, published 6 January 2022.

**Which products and versions are affected?** org.typelevel:jawn-parser_0.25 (Maven) ECOSYSTEM:introduced=0; org.typelevel:jawn-parser_0.27 (Maven) ECOSYSTEM:introduced=0; org.typelevel:jawn-parser_2.10 (Maven) ECOSYSTEM:introduced=0; org.typelevel:jawn-parser_2.11 (Maven) ECOSYSTEM:introduced=0; and 14 more.

**Is there a fix for CVE-2022-21653?** Yes. org.typelevel:jawn-parser_2.12 (Maven): upgrade to 1.3.2 or later; org.typelevel:jawn-parser_2.13 (Maven): upgrade to 1.3.2 or later; org.typelevel:jawn-parser_3 (Maven): upgrade to 1.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2022-21653?** Check whether you run org.typelevel:jawn-parser_0.25 (Maven), org.typelevel:jawn-parser_0.27 (Maven), org.typelevel:jawn-parser_2.10 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.typelevel:jawn-parser_2.12 (Maven): upgrade to 1.3.2 or later

  ```sh
  # set org.typelevel:jawn-parser_2.12 to 1.3.2 in your pom.xml or build.gradle
  ```

- org.typelevel:jawn-parser_2.13 (Maven): upgrade to 1.3.2 or later

  ```sh
  # set org.typelevel:jawn-parser_2.13 to 1.3.2 in your pom.xml or build.gradle
  ```

- org.typelevel:jawn-parser_3 (Maven): upgrade to 1.3.2 or later

  ```sh
  # set org.typelevel:jawn-parser_3 to 1.3.2 in your pom.xml or build.gradle
  ```


## Affected products

- org.typelevel:jawn-parser_0.25 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_0.27 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_2.10 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_2.11 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=1.3.2
- org.typelevel:jawn-parser_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=1.3.2
- org.typelevel:jawn-parser_2.13.0-M5 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_2.13.0-RC1 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_2.13.0-RC2 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_2.13.0-RC3 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_3 (Maven) ECOSYSTEM:introduced=0,fixed=1.3.2
- org.typelevel:jawn-parser_3.0.0-M1 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_3.0.0-M2 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_3.0.0-M3 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_3.0.0-RC1 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_3.0.0-RC2 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parser_3.0.0-RC3 (Maven) ECOSYSTEM:introduced=0
- org.typelevel:jawn-parserg (Maven) ECOSYSTEM:introduced=0

## Identifiers

- CVE-2022-21653
- GHSA-vc89-hccf-rq55

## Related threats

- [Typelevel Jawn AsyncParser quadratic parsing effort denial of service](https://junglewise.ai/threats/cve-2026-61814-typelevel-jawn-asyncparser-quadratic-parsing-effort-denial-of)
- [Jawn JSON parser denial of service via uncontrolled nesting depth](https://junglewise.ai/threats/cve-2026-59990-jawn-json-parser-denial-of-service-via-uncontrolled-nesting-depth)