Résumé
Jawn: Quadratic parsing effort in AsyncParser
Détails de l’avis
AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.
Impact
Denial of service via CPU exhaustion when parsing untrusted JSON.
Preconditions:
- Application uses
AsyncParser - Attacker can send large tokens with control over chunk sizes.
Patches
Fixed in jawn-parser-1.7.0.
Workarounds
If you can't upgrade immediately:
- Use the synchronous
Parser. - Buffer incoming bytes into larger chunks before calling
absorb
Références
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-95838
containerd: Unpack DoS via repeated opaque whiteouts
- MEDIUMCVE-2026-107287
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
- MEDIUMCVE-2026-104844
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
- MEDIUMGHSA-hx4r-w6wj-j8fg
devalue: Residual sparse-array CPU amplification in uneval
- HIGHCVE-2026-102999
pypdf: Possible long runtimes with large amount of embedded files
- HIGHCVE-2026-102997
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)