CVE-2026-61814 Details

A denial-of-service vulnerability has been identified in Jawn, an open-source JSON parser, in versions prior to 1.7.0. The issue arises in the AsyncParser component, which can be manipulated to perform quadratic processing time when a single JSON token is split into many small chunks. This is because each absorb call rescans the incomplete token from the beginning. A remote attacker controlling untrusted JSON input and its chunk sizes can exploit this behavior to exhaust CPU resources, leading to a denial-of-service condition in applications that use AsyncParser.

Users are advised to upgrade to Jawn version 1.7.0, where this vulnerability has been fixed. If an immediate upgrade is not possible, consider using the synchronous Parser or buffering incoming bytes into larger chunks before calling the absorb method.