JSON Parsing Vulnerability in Jawn Open Source Parser

CVE-2026-61814

What is CVE-2026-61814?

The Jawn JSON parser, prior to version 1.7.0, contains a vulnerability in its AsyncParser implementation. When processing JSON tokens delivered in small, fragmented chunks, the parser can enter a state of excessive CPU resource consumption. This behavior occurs because each call to absorb on incomplete tokens forces the parser to rescan from the beginning. A remote attacker can exploit this flaw by controlling the input of untrusted JSON data, leading to potential denial of service in applications relying on Jawn. The vulnerability has been addressed in version 1.7.0.

References