Denial of Service and Memory Exhaustion in aeson

Summary

# Denial of Service and Memory Exhaustion in aeson

A Denial of Service (DoS) and memory exhaustion vulnerability was identified in the `aeson` package. The vulnerability allows an attacker to exhaust server memory and crash the host process by supplying maliciously crafted JSON payloads.

The vulnerability exists in `aeson`'s `withBoundedScientific_` function (located in `src/Data/Aeson/Types/FromJSON.hs`). The exponent bounds check only rejects large positive exponents (`exp10 > 1024`) but fails to reject arbitrarily large negative exponents.

When an attacker sends a JSON number with a massive negative exponent (e.g., `1e-999999999`), the value bypasses the check and flows into `realToFrac`, which computes `fromRational . toRational`. For such a large negative exponent, `toRational` produces a GMP Integer with approximately 1 billion decimal digits, causing immediate and severe memory exhaustion.

Affected `FromJSON` instances:

* `Fixed a` (including `Centi`, `Pico`, `Nano`, etc.) * `NominalDiffTime` * `DiffTime`

## Resolution

The issue was resolved by introducing proper bounds checks:

- `aeson` now applies an absolute bounds check to both positive and negative exponents (`abs exp10 > 1024`).

The fix first shipped in `aeson-2.3.0.0`, and have been backported to the previous release series as `aeson-2.2.5.1`.

Users are strongly advised to update to the patched versions:

* `aeson-2.2.5.1` or later

## Acknowledgements

The vulnerabilities were reported Nathan Walsh, and patched by Li-yao Xia.