---
id: CVE-2026-61814
title: Jawn is an open source JSON parser
summary: >-
  Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can
  perform quadratic work when a single JSON token is delivered across many small
  chunks because each absorb call rescans the incomplete token from the start. A
  remo…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-407
vendor: typelevel
product: jawn
affected:
  - jawn < 1.7.0
  - jawn-parser_2.12 < 1.7.0
  - jawn-parser_2.13 < 1.7.0
  - jawn-parser_3 < 1.7.0
published: '2026-09-23'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T20:17:12.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61814'
references:
  - url: >-
      https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b
    label: security-advisories@github.com
  - url: 'https://github.com/typelevel/jawn/releases/tag/v1.7.0'
    label: security-advisories@github.com
  - url: 'https://github.com/typelevel/jawn/security/advisories/GHSA-w4cm-gvhj-cgw6'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-w4cm-gvhj-cgw6'
tags:
  - nvd
  - cve.org
  - ghsa
  - maven
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-23T19:25:56.569425Z'
ingestedAt: '2026-09-23T19:31:04.462Z'
aliases:
  - GHSA-w4cm-gvhj-cgw6
ecosystem: maven
patched:
  - 'org.typelevel:jawn-parser_2.12 1.7.0'
  - 'org.typelevel:jawn-parser_2.13 1.7.0'
  - 'org.typelevel:jawn-parser_3 1.7.0'
epss: 0.00567
epssPercentile: 0.44614
---

## Overview

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61814)

Affected packages:

- `org.typelevel:jawn-parser_2.12 <= 1.6.0`
- `org.typelevel:jawn-parser_2.13 <= 1.6.0`
- `org.typelevel:jawn-parser_3 <= 1.6.0`

Patched in:

- `org.typelevel:jawn-parser_2.12 1.7.0`
- `org.typelevel:jawn-parser_2.13 1.7.0`
- `org.typelevel:jawn-parser_3 1.7.0`

Source: https://github.com/advisories/GHSA-w4cm-gvhj-cgw6