CVE-2026-59990
Received Received - Intake

Jawn JSON Parser Denial of Service via Deep Nesting

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-59990
EUVD
EUVD-2026-85554

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
typelevel jawn to 1.6.1 (inc)
typelevel jawn to 1.7.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Jawn, a JSON parser for Scala. Before version 1.7.0, it allowed untrusted JSON with arbitrarily deep nesting without limits. This could cause the JVM to run out of memory, leading to a fatal java.lang.OutOfMemoryError that crashes applications and causes denial of service.

Detection Guidance

To detect this vulnerability, monitor for excessive memory usage or crashes when processing JSON data. Check application logs for java.lang.OutOfMemoryError exceptions during JSON parsing. Use system monitoring tools like top, htop, or JVM-specific tools like VisualVM to observe heap exhaustion patterns.

Impact Analysis

An attacker could send maliciously crafted JSON with extreme nesting to crash your application by exhausting server memory. This disrupts service availability and may require restarting the application or server.

Mitigation Strategies
  • Upgrade Jawn to version 1.7.0 or later to apply the patch for uncontrolled nesting depth.
  • Set a system property 'jawn.parser.maxDepth' to a lower value than the default 4096 if deeper nesting is not required.
  • Implement input size limits or pre-scan JSON documents to reject excessively nested structures before parsing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59990. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart