GHSA-w4cm-gvhj-cgw6
Jawn: Quadratic parsing effort in AsyncParser
Quick fix
GHSA-w4cm-gvhj-cgw6 — org.typelevel:jawn-parser_2.12: upgrade to the fixed version with the command below.
# pom.xml: bump <version>1.7.0</version> for org.typelevel:jawn-parser_2.12Details
`AsyncParser` can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each `absorb` call rescans the incomplete token from the start.
### Impact
Denial of service via CPU exhaustion when parsing untrusted JSON.
Preconditions: - Application uses `AsyncParser` - Attacker can send large tokens with control over chunk sizes.
### Patches
Fixed in jawn-parser-1.7.0.
### Workarounds
If you can't upgrade immediately: - Use the synchronous `Parser`. - Buffer incoming bytes into larger chunks before calling `absorb`
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 1.7.0# pom.xml: bump <version>1.7.0</version> for org.typelevel:jawn-parser_2.120Fixed in: 1.7.0# pom.xml: bump <version>1.7.0</version> for org.typelevel:jawn-parser_2.130Fixed in: 1.7.0# pom.xml: bump <version>1.7.0</version> for org.typelevel:jawn-parser_3