Advisories for Maven/Org.typelevel/Jawn-Parser_2.12 package

The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input.

AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.

Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library: Affected implementations include: org.http4s :: http4s-play-json org.typelevel :: jawn-ast (< 0.8.0) org.typelevel :: jawn-play (discontinued) org.typelevel :: jawn-rojoma (discontinued) org.typelevel :: jawn-spray (discontinued) Unaffected implementations include: io.argonaut :: argonaut-jawn io.circe :: circe-parser org.typelevel :: jawn-ast (>= 0.8.0) org.typelevel :: jawn-json4s …