CVE-2018-18855 json
Uncontrolled Resource Consumption in Spray JSON
published 2022-06-28 4 y ago modified 2025-09-30 13 mo ago also GHSA-ww3v-6xjf-jv28
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
Patch / fix
- maven io.spray:spray-json_2.10 1.3.5
- maven io.spray:spray-json_2.11 1.3.5
- maven io.spray:spray-json_2.12 1.3.5
- maven io.spray:spray-json_2.13.0-M5 1.3.5
- github.com/spray/spray-json#284 pull request
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.spray:spray-json_2.10 | <1.3.5 |
1.3.5 |
| maven | io.spray:spray-json_2.11 | <1.3.5 |
1.3.5 |
| maven | io.spray:spray-json_2.11.0-RC4 | all versions |
no fix listed |
| maven | io.spray:spray-json_2.12 | <1.3.5 |
1.3.5 |
| maven | io.spray:spray-json_2.12.0-M3 | all versions |
no fix listed |
| maven | io.spray:spray-json_2.12.0-M5 | all versions |
no fix listed |
| maven | io.spray:spray-json_2.12.0-RC1 | all versions |
no fix listed |
| maven | io.spray:spray-json_2.12.0-RC2 | all versions |
no fix listed |
| maven | io.spray:spray-json_2.13.0-M2 | all versions |
no fix listed |
| maven | io.spray:spray-json_2.13.0-M4 | all versions |
no fix listed |
| maven | io.spray:spray-json_2.13.0-M5 | <1.3.5 |
1.3.5 |
| maven | io.spray:spray-json_2.9.3 | all versions |
no fix listed |
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
Sources
- GitHub Advisory GHSA-ww3v-6xjf-jv28
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.