Denial of Service Vulnerability in Jawn JSON Parser from Typelevel

CVE-2026-59990

What is CVE-2026-59990?

A denial of service vulnerability exists in the Jawn JSON parser prior to version 1.7.0, where it allows an attacker to submit untrusted JSON with deep array or object nesting. This can lead to the exhaustion of the Java Virtual Machine (JVM) heap memory, causing the application to crash from a java.lang.OutOfMemoryError. This critical issue is a major concern for applications relying on Jawn, as it isn't typically managed by standard error-handling mechanisms within Scala. The vulnerability is resolved in the latest version 1.7.0.

References