CVE-2018-18854

7.5 highEPSS 1.9%

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-400
Published: 2018-10-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

lightbend:spray-json

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-q8xj-8xg3-w432	Maven	io.spray:spray-json_2.12	<1.3.5	1.3.5
GHSA-q8xj-8xg3-w432	Maven	io.spray:spray-json_2.11	<1.3.5	1.3.5
GHSA-q8xj-8xg3-w432	Maven	io.spray:spray-json_2.10	<1.3.5	1.3.5

References

https://github.com/spray/spray-json/issues/277
https://github.com/spray/spray-json/issues/277

Check your stack JSON