CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2022-21653
High (7.5) in typelevel jawn. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in org.typelevel:jawn-parser_2.12 1.3.2.
Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-326, CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- typelevel:jawn
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_0.25 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parserg | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_0.27 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_2.10 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_2.11 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_2.12 | <1.3.2 | 1.3.2 |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_2.13 | <1.3.2 | 1.3.2 |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_2.13.0-M5 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_2.13.0-RC1 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_2.13.0-RC2 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_2.13.0-RC3 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_3 | <1.3.2 | 1.3.2 |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_3.0.0-M1 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_3.0.0-M2 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_3.0.0-M3 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_3.0.0-RC1 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_3.0.0-RC2 | all versions | no fix published |
| GHSA-vc89-hccf-rq55 | Maven | org.typelevel:jawn-parser_3.0.0-RC3 | all versions | no fix published |