CVE-2026-59990: Jawn: Uncontrolled nesting depth in JSON parser
The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input.
References
- github.com/advisories/GHSA-cc4v-rvgp-2pf3
- github.com/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04
- github.com/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed
- github.com/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b
- github.com/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214
- github.com/typelevel/jawn/releases/tag/v1.7.0
- github.com/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3
- nvd.nist.gov/vuln/detail/CVE-2026-59990
Code Behaviors & Features
Detect and mitigate CVE-2026-59990 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →