Jawn AsyncParser Denial of Service via Quadratic Parsing Complexity

The jawn-parser library contains a vulnerability (CVE-2026-61814) in its AsyncParser component that allows for a denial-of-service (DoS) attack through CPU exhaustion. When the parser processes JSON tokens delivered in small, fragmented chunks, it performs redundant rescanning of the incomplete token during each absorb call. This quadratic complexity (O(n^2)) on the input length allows an attacker who can influence the size and delivery frequency of JSON chunks to force the application to consume excessive CPU resources. This affects users of jawn-parser versions 1.6.0 and earlier across Scala versions 2.12, 2.13, and 3. Defenders should prioritize upgrading to version 1.7.0 or switching to the synchronous Parser implementation if an immediate upgrade is not feasible.

Impact

Successful exploitation results in high CPU utilization, which can lead to service degradation or complete denial of service for applications processing untrusted JSON streams. This vulnerability impacts systems utilizing jawn-parser for high-throughput or internet-facing data ingestion where attackers can control the byte-level fragmentation of incoming JSON payloads.

Recommendation

• Upgrade jawn-parser to version 1.7.0 or later to include the fix for CVE-2026-61814.
• For systems unable to upgrade, implement input buffering to ensure large chunks are provided to the absorb method, mitigating the repeated rescanning overhead.
• Migrate to the synchronous Parser class for sensitive ingestion points where fragmentation control cannot be guaranteed.