Executive brief
Jawn is a JSON parser library used in Scala and Java applications. An attacker who can submit JSON data to an application using Jawn can craft a deeply nested JSON document that exhausts server memory (JVM heap), causing an OutOfMemoryError and crashing the application. This results in denial of service, taking the application offline until it is restarted.
Technical details
This is a resource exhaustion vulnerability (CWE-770) in the Jawn JSON parser. The parser recursively processes nested JSON structures without enforcing a maximum nesting depth, allowing deeply nested JSON to consume unbounded stack and heap memory. An unauthenticated remote attacker can submit a JSON payload with excessive nesting depth to any application endpoint that uses Jawn's parse methods, triggering OutOfMemoryError—a fatal JVM error that typically bypasses error handling mechanisms like scala.util.Try or cats.effect.IO. The attack requires no authentication or privileges. Version 1.6.1 introduces a configurable maxDepth parameter (default 4096) that causes ParseException instead of heap exhaustion, making the error recoverable.
Affected products
- Typelevel Jawn <= 1.6.0
Timeline
- 2026-06-24: disclosed
- 2026-09-23: patched: Version 1.6.1 and 1.7.0 released with maxDepth limit