Skip to content
Heist/ feed
Back to feed
High

Jawn: Uncontrolled nesting depth in JSON parser

Type: advisorySources: OSV

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-59990
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 03:29 UTC · Revision 1

Source evidence

Jawn: Uncontrolled nesting depth in JSON parser

core-osv · Original source

Published 23 Sept 2026, 18:41 UTC

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.

osv:CVE-2026-59990
Complete source record
{
  "id": "5739324e27ce0877b6ac667fbfb27e7f6359a528b381df2b2d10bb4f1afef776",
  "url": "https://osv.dev/vulnerability/CVE-2026-59990",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Jawn: Uncontrolled nesting depth in JSON parser",
    "summary": "Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.",
    "evidence": "osv:CVE-2026-59990",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-59990",
      "aliases": [
        "CVE-2026-59990",
        "GHSA-cc4v-rvgp-2pf3"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/typelevel/jawn",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "29dfc7e761e1430b18a7e813ee37b73e2908ab64"
                },
                {
                  "fixed": "191cb3a44e77f1afab439ee636bf66bdf3c54a04"
                },
                {
                  "fixed": "6219666641f9408498f85868f835e17bd8a72fed"
                },
                {
                  "fixed": "93ac93e9c992c11b4c03d5455d8551f9fb24da1b"
                },
                {
                  "fixed": "f6ace7e0db715de1a8c4618bed9378333a5c2214"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.7.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "191cb3a44e77f1afab439ee636bf66bdf3c54a04"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "6219666641f9408498f85868f835e17bd8a72fed"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "93ac93e9c992c11b4c03d5455d8551f9fb24da1b"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "f6ace7e0db715de1a8c4618bed9378333a5c2214"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "29dfc7e761e1430b18a7e813ee37b73e2908ab64"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.7.0"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.6.0",
            "v1.5.1",
            "v1.5.0",
            "v1.4.0",
            "v1.3.2",
            "v1.3.0",
            "v1.2.0",
            "v1.1.2",
            "v1.1.1",
            "v1.1.0",
            "v1.0.3",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0",
            "v1.0.0-RC4",
            "v1.0.0-RC3",
            "v1.0.0-RC2",
            "v1.0.0-RC1",
            "v0.14.2",
            "v0.14.1",
            "v0.14.0",
            "v0.13.0",
            "v0.12.2",
            "v0.12.1",
            "v0.12.0",
            "v0.11.1",
            "v0.11.0",
            "v0.10.4",
            "v0.10.2",
            "v0.10.1",
            "v0.10.0",
            "v0.9.0",
            "v0.8.4",
            "v0.8.3",
            "v0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.4",
            "v0.7.2",
            "v0.7.1",
            "v0.7.0",
            "v0.6.0",
            "v0.5.5",
            "v0.5.4",
            "v0.5.3",
            "v0.5.1",
            "v0.5.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59990.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:53.500213054Z",
      "provider": "osv",
      "references": [
        "https://github.com/typelevel/jawn/releases/tag/v1.7.0",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59990.json",
        "https://github.com/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-59990",
        "https://github.com/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04",
        "https://github.com/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed",
        "https://github.com/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b",
        "https://github.com/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-770"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59990.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-59990",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 522219,
  "published_at": "2026-09-23T18:41:12.073+00:00"
}