CVE-2026-61814
Received Received - Intake

Jawn AsyncParser Quadratic Time Denial of Service

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-61814
EUVD
EUVD-2026-85551

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
typelevel jawn to 1.7.0 (exc)
typelevel jawn 1.7.0
typelevel jawn From 1.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61814 is a denial-of-service vulnerability in Jawn's AsyncParser, a JSON parser library. It occurs when a single JSON token is split into many small chunks. Each processing step rescans the incomplete token from the start, causing quadratic time complexity (O(n^2)) and excessive CPU usage.

Detection Guidance

To detect this vulnerability, check if your system uses Jawn library versions 1.6.0 or earlier. Inspect dependency files like build.sbt or pom.xml for Jawn version. If using AsyncParser, monitor CPU usage spikes during JSON parsing operations, especially with untrusted input.

Impact Analysis

An attacker can exploit this by sending specially crafted JSON input with controlled chunk sizes. This leads to CPU exhaustion, causing denial-of-service in applications using AsyncParser. The impact is high availability disruption without requiring privileges or user interaction.

Mitigation Strategies

Upgrade Jawn to version 1.7.0 or later immediately. If immediate upgrade is not possible, switch from AsyncParser to the synchronous Parser. Alternatively, buffer incoming bytes into larger chunks before calling absorb to reduce quadratic parsing effort.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61814. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart