Skip to content
Threat Feed
Subscribe

Tag

Jvm

2 briefs RSS
low advisory

Jawn AsyncParser Denial of Service via Quadratic Parsing Complexity

The jawn-parser library is vulnerable to a denial-of-service condition where fragmented input triggers quadratic parsing effort, leading to CPU exhaustion.

jawn-parser denial-of-service library-vulnerability jvm
1t 1c
medium advisory

Unbounded WebSocket Message Aggregation Leads to Denial of Service in http4s-blaze-server

A vulnerability in `http4s-blaze-server` allows an attacker to cause a denial of service by exploiting unbounded WebSocket message aggregation, enabling an attacker to drive unbounded heap growth in the server's JVM by sending an unterminated fragmented WebSocket message, leading to an `OutOfMemoryError` and server termination, affecting any http4s application serving WebSocket routes over `BlazeServerBuilder` and triggerable by unauthenticated or authenticated clients.

http4s-blaze-server_2.13 +3 denial-of-service webserver jvm websocket
1t