CVE-2026-61814: Jawn JSON Parser DOS Vulnerability

CVE-2026-61814 Overview

Jawn is an open source JSON parser widely used in Scala ecosystems. A denial-of-service vulnerability affects Jawn versions prior to 1.7.0. The AsyncParser performs quadratic work when a single JSON token is delivered across many small chunks. Each absorb call rescans the incomplete token from the start, allowing a remote attacker who controls untrusted JSON input and its chunk sizes to exhaust CPU resources. Applications consuming untrusted streaming JSON through AsyncParser are exposed to remote denial of service. The issue is resolved in version 1.7.0.

Critical Impact
Remote attackers can trigger CPU exhaustion and denial of service in any service that streams untrusted JSON through Jawn's AsyncParser.

Affected Products

Jawn JSON parser versions prior to 1.7.0
Scala applications and libraries embedding Jawn's AsyncParser for streaming JSON
Downstream libraries such as circe-jawn and http4s modules that rely on Jawn for async parsing

Discovery Timeline

2026-09-23 - CVE-2026-61814 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61814

Vulnerability Analysis

The flaw is an algorithmic complexity vulnerability categorized under [CWE-400] Uncontrolled Resource Consumption. Jawn's AsyncParser accepts incremental input through repeated absorb(ByteBuffer) calls. When a large JSON token, such as a very long string or number, is delivered piecewise, the parser rescans the entire accumulated buffer from the token's starting offset on every call. Processing n chunks of a single token therefore results in O(n^2) scanning work rather than O(n). An attacker who controls both the payload and chunk boundaries can drive an application into sustained CPU saturation with modest bandwidth. The impact is limited to availability; confidentiality and integrity are not affected.

Root Cause

The root cause resides in parser/shared/src/main/scala/jawn/AsyncParser.scala. The parser did not track how much of an in-progress token had already been examined. Every subsequent absorb restarted scanning from the token's original offset, repeating work over previously validated bytes.

Attack Vector

Exploitation requires only network reachability to an endpoint that streams untrusted JSON into AsyncParser. The attacker submits a single oversized JSON token, such as a multi-megabyte string literal, split into many small chunks. Each chunk delivery multiplies parser work, driving CPU to full utilization and denying service to legitimate requests.

scala

// Security patch excerpt from AsyncParser.scala (v1.7.0)
// Source: https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b

final protected[this] def line(): Int = _line
final protected[this] def column(i: Int): Int = i - pos

-  final def copy(): AsyncParser[J] =
-    new AsyncParser(state, curr, context, stack, data.clone, len, allocated, offset, done, streamMode, multiValue)
+  private[jawn] var rescanSize: Int = 0
+
+  final def copy(): AsyncParser[J] = {
+    val p =
+      new AsyncParser(state, curr, context, stack, data.clone, len, allocated, offset, done, streamMode, multiValue)
+    p.rescanSize = rescanSize
+    p
+  }

The patch introduces a rescanSize field that records the extent of prior scan progress, so subsequent absorb calls resume from where the previous scan stopped rather than restarting from the token's origin.

Detection Methods for CVE-2026-61814

Indicators of Compromise

Sustained single-core CPU saturation in JVM processes hosting Scala services that parse streaming JSON
HTTP request traces showing extremely slow POST or streaming uploads that transmit JSON payloads in unusually small TCP segments or chunked-encoding fragments
Thread dumps repeatedly showing execution inside jawn.AsyncParser.absorb or related parse loops

Detection Strategies

Inventory application dependencies for org.typelevel:jawn-parser and transitive users such as circe-jawn at versions below 1.7.0
Instrument JSON ingestion endpoints to record request duration relative to payload byte count; flag requests where parse time grows non-linearly with size
Add request timeouts and log warnings when JSON parsing exceeds a threshold to surface potential abuse

Monitoring Recommendations

Alert on prolonged high CPU utilization on services that expose public JSON APIs
Monitor upstream proxies for clients that consistently send small chunk sizes with large aggregate payloads
Track request-latency outliers on endpoints backed by Jawn-based parsers such as http4s or circe integrations

How to Mitigate CVE-2026-61814

Immediate Actions Required

Upgrade Jawn to version 1.7.0 or later in all direct and transitive dependencies
Rebuild and redeploy Scala services that consume streaming JSON through AsyncParser
Enforce request-size and request-time limits on any endpoint that accepts untrusted JSON

Patch Information

The fix is available in Jawn 1.7.0, released by the typelevel project. See the GitHub Release v1.7.0 notes, the security advisory GHSA-w4cm-gvhj-cgw6, and the remediation commit for full details. The patch introduces a rescanSize field so absorb resumes scanning from the last examined offset rather than restarting from the token origin.

Workarounds

Place a reverse proxy in front of vulnerable services to reject requests with abnormally small chunk sizes or excessive total JSON body size
Buffer full request bodies before invoking AsyncParser, converting streaming parsing to single-shot parsing for untrusted input
Apply strict CPU-time and wall-clock timeouts to JSON parsing tasks and terminate long-running parses

bash

# Example sbt dependency pin to the fixed version
libraryDependencies += "org.typelevel" %% "jawn-parser" % "1.7.0"

# Verify no vulnerable versions remain in the dependency tree
sbt "whatDependsOn org.typelevel jawn-parser"