CVE-2026-59990: Jawn JSON parser denial of service via uncontrolled nesting depth

CVE-2026-59990 · Severity: high · CVSS 7.5 · Published 2026-09-23

Jawn is a JSON parser library used in Scala and Java applications. An attacker who can submit JSON data to an application using Jawn can craft a deeply nested JSON document that exhausts server memory (JVM heap), causing an OutOfMemoryError and crashing the application. This results in denial of service, taking the application offline until it is restarted.

Technologies: org.typelevel:jawn-parser_2.12 (Maven), org.typelevel:jawn-parser_2.13 (Maven), org.typelevel:jawn-parser_3 (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-59990 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59990 being exploited in the wild.
How severe is CVE-2026-59990?
High severity, with a CVSS score of 7.5, published 23 September 2026.
Which products and versions are affected?
org.typelevel:jawn-parser_2.12 (Maven) <= 1.6.0, ECOSYSTEM:introduced=0,fixed=1.7.0; org.typelevel:jawn-parser_2.13 (Maven) <= 1.6.0, ECOSYSTEM:introduced=0,fixed=1.7.0; org.typelevel:jawn-parser_3 (Maven) <= 1.6.0, ECOSYSTEM:introduced=0,fixed=1.7.0; Typelevel Jawn <= 1.6.0.
Is there a fix for CVE-2026-59990?
Yes. org.typelevel:jawn-parser_2.12 (Maven): upgrade to 1.7.0 or later; org.typelevel:jawn-parser_2.13 (Maven): upgrade to 1.7.0 or later; org.typelevel:jawn-parser_3 (Maven): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59990 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59990?
Check whether you run org.typelevel:jawn-parser_2.12 (Maven), org.typelevel:jawn-parser_2.13 (Maven), org.typelevel:jawn-parser_3 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.typelevel:jawn-parser_2.12 (Maven): upgrade to 1.7.0 or later
    # set org.typelevel:jawn-parser_2.12 to 1.7.0 in your pom.xml or build.gradle
  • org.typelevel:jawn-parser_2.13 (Maven): upgrade to 1.7.0 or later
    # set org.typelevel:jawn-parser_2.13 to 1.7.0 in your pom.xml or build.gradle
  • org.typelevel:jawn-parser_3 (Maven): upgrade to 1.7.0 or later
    # set org.typelevel:jawn-parser_3 to 1.7.0 in your pom.xml or build.gradle

Technical details

This is a resource exhaustion vulnerability (CWE-770) in the Jawn JSON parser. The parser recursively processes nested JSON structures without enforcing a maximum nesting depth, allowing deeply nested JSON to consume unbounded stack and heap memory. An unauthenticated remote attacker can submit a JSON payload with excessive nesting depth to any application endpoint that uses Jawn's parse methods, triggering OutOfMemoryError—a fatal JVM error that typically bypasses error handling mechanisms like scala.util.Try or cats.effect.IO. The attack requires no authentication or privileges. Version 1.6.1 introduces a configurable maxDepth parameter (default 4096) that causes ParseException instead of heap exhaustion, making the error recoverable.

Affected products

  • Typelevel Jawn <= 1.6.0

Identifiers

  • CVE-2026-59990
  • GHSA-cc4v-rvgp-2pf3

Timeline

  • 2026-06-24: disclosed
  • 2026-09-23: patched: Version 1.6.1 and 1.7.0 released with maxDepth limit

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.