https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T21:34:42.982768+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-232849 EUVD-2026-232849 2026-10-03T21:34:43.090106+00:00 EUVD-2026-232849 https://cve.radiocsirt.org/vuln/fkie_cve-2022-21653 fkie_cve-2022-21653 2026-10-03T21:34:43.090142+00:00

Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.

 https://cve.radiocsirt.org/vuln/ghsa-vc89-hccf-rq55 GHSA-vc89-hccf-rq55 — Hash collision in typelevel jawn 2026-10-03T21:34:43.090177+00:00

Affected: Maven: org.typelevel:jawn-parser_0.25, Maven: org.typelevel:jawn-parserg, Maven: org.typelevel:jawn-parser_0.27, Maven: org.typelevel:jawn-parser_2.10, Maven: org.typelevel:jawn-parser_2.11, Maven: org.typelevel:jawn-parser_2.12, Maven: org.typelevel:jawn-parser_2.13, Maven: org.typelevel:jawn-parser_2.13.0-M5, Maven: org.typelevel:jawn-parser_2.13.0-RC1, Maven: org.typelevel:jawn-parser_2.13.0-RC2 and 8 more

### Impact

Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include: * `org.http4s` :: `http4s-play-json` * `org.typelevel :: jawn-ast` (< 0.8.0) * `org.typelevel :: jawn-play` (discontinued) * `org.typelevel :: jawn-rojoma` (discontinued) * `org.typelevel :: jawn-spray` (discontinued)

Unaffected implementations include: * `io.argonaut :: argonaut-jawn` * `io.circe :: circe-parser` * `org.typelevel :: jawn-ast` (>= 0.8.0) * `org.typelevel :: jawn-json4s` (discontinued) * `org.typelevel :: jawn-argonaut` (discontinued)

### Patches

`jawn-parser-1.3.2` fixes the issue.

### Workarounds

Override `objectContext()` to use a collision-safe collection. See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.

### References

* https://github.com/typelevel/jawn/pull/390

### Credits

* @kag0, for the report and the patch

### For more information If you have any questions or comments about this advisory: * Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn) * E-mail a maintainer: * [@rossabaker](mailto:ross@rossabaker.com)

 https://cve.radiocsirt.org/vuln/gsd-2022-21653 gsd-2022-21653 2026-10-03T21:34:43.090241+00:00 gsd-2022-21653 https://cve.radiocsirt.org/vuln/opensuse-su-2022:0011-1 openSUSE-SU-2022:0011-1 — Security update for jawn 2026-10-03T21:34:43.090256+00:00

Security update for jawn

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-21653 UBUNTU-CVE-2022-21653 2026-10-03T21:34:43.090274+00:00

Affected: Ubuntu:20.04:LTS: jawn, Ubuntu:22.04:LTS: jawn, Ubuntu:24.04:LTS: jawn, Ubuntu:25.10: jawn, Ubuntu:26.04:LTS: jawn

Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.