Threats affecting pkg:github/typelevel/jawn

Jawn is an open source JSON parser that prior to version 1.7.0 allowed parsing of JSON with arbitrarily deep nesting without limits. This could cause the parser to exhaust the JVM heap memory, resulting in a fatal OutOfMemoryError and denial of service. The issue is fixed in version 1.7.0.

Jawn is an open source JSON parser with a vulnerability in its AsyncParser component prior to version 1.7.0. The AsyncParser can perform quadratic work when processing a single JSON token delivered in many small chunks, leading to excessive CPU consumption. This can be exploited by a remote attacker controlling untrusted JSON input and chunk sizes to cause a denial of service. The issue is fixed in version 1.7.0.