CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2018-18853
High (7.5) in lightbend spray-json. EPSS 1.9% chance of exploitation in the next 30 days. Fixed in io.spray:spray-json_2.12 1.3.5.
Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of a field composed of many decimal digits.
Severity
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- lightbend:spray-json
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f94m-mqhr-mc29 | Maven | io.spray:spray-json_2.12 | <1.3.5 | 1.3.5 |
| GHSA-f94m-mqhr-mc29 | Maven | io.spray:spray-json_2.11 | <1.3.5 | 1.3.5 |
| GHSA-f94m-mqhr-mc29 | Maven | io.spray:spray-json_2.10 | <1.3.5 | 1.3.5 |