CVE-2026-59990 json
Jawn: Uncontrolled nesting depth in JSON parser
published 2026-09-23 46 d ago modified 2026-09-30 39 d ago also EUVD-2026-85554 , GHSA-cc4v-rvgp-2pf3
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.
Patch / fix
- maven org.typelevel:jawn-parser_2.12 1.7.0
- maven org.typelevel:jawn-parser_2.13 1.7.0
- maven org.typelevel:jawn-parser_3 1.7.0
- typelevel jawn 1.7.0
- org.typelevel jawn-parser_2.12 1.7.0
- org.typelevel jawn-parser_2.13 1.7.0
- org.typelevel jawn-parser_3 1.7.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 46 d ago
Exploit prediction
0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.typelevel:jawn-parser_2.12 | <1.7.0 |
1.7.0 |
| maven | org.typelevel:jawn-parser_2.13 | <1.7.0 |
1.7.0 |
| maven | org.typelevel:jawn-parser_3 | <1.7.0 |
1.7.0 |
Affected products
- typelevel jawn
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04
web
-
github.com
/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed
web
-
github.com
/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b
web
-
github.com
/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214
web
-
github.com
/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3
web
-
github.com
/typelevel/jawn/releases/tag/v1.7.0
web
-
github.com
/typelevel/jawn
package
Sources
- CVE List CVE-2026-59990
- GitHub Advisory GHSA-cc4v-rvgp-2pf3
- NVD CVE-2026-59990
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.