Most recent entries from all

EUVD-2026-232849

fkie_cve-2022-21653

Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.

GHSA-vc89-hccf-rq55 — Hash collision in typelevel jawn

Affected: Maven: org.typelevel:jawn-parser_0.25, Maven: org.typelevel:jawn-parserg, Maven: org.typelevel:jawn-parser_0.27, Maven: org.typelevel:jawn-parser_2.10, Maven: org.typelevel:jawn-parser_2.11, Maven: org.typelevel:jawn-parser_2.12, Maven: org.typelevel:jawn-parser_2.13, Maven: org.typelevel:jawn-parser_2.13.0-M5, Maven: org.typelevel:jawn-parser_2.13.0-RC1, Maven: org.typelevel:jawn-parser_2.13.0-RC2 and 8 more

### Impact

Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include: * `org.http4s` :: `http4s-play-json` * `org.typelevel :: jawn-ast` (< 0.8.0) * `org.typelevel :: jawn-play` (discontinued) * `org.typelevel :: jawn-rojoma` (discontinued) * `org.typelevel :: jawn-spray` (discontinued)

Unaffected implementations include: * `io.argonaut :: argonaut-jawn` * `io.circe :: circe-parser` * `org.typelevel :: jawn-ast` (>= 0.8.0) * `org.typelevel :: jawn-json4s` (discontinued) * `org.typelevel :: jawn-argonaut` (discontinued)

### Patches

`jawn-parser-1.3.2` fixes the issue.

### Workarounds

Override `objectContext()` to use a collision-safe collection. See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.

### References

* https://github.com/typelevel/jawn/pull/390

### Credits

* @kag0, for the report and the patch

### For more information If you have any questions or comments about this advisory: * Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn) * E-mail a maintainer: * [@rossabaker](mailto:ross@rossabaker.com)

gsd-2022-21653

openSUSE-SU-2022:0011-1 — Security update for jawn

Security update for jawn

UBUNTU-CVE-2022-21653

Affected: Ubuntu:20.04:LTS: jawn, Ubuntu:22.04:LTS: jawn, Ubuntu:24.04:LTS: jawn, Ubuntu:25.10: jawn, Ubuntu:26.04:LTS: jawn