CVE-2026-61814: Jawn: Quadratic parsing effort in AsyncParser

September 23, 2026

AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.

References

github.com/advisories/GHSA-w4cm-gvhj-cgw6
github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b
github.com/typelevel/jawn/releases/tag/v1.7.0
github.com/typelevel/jawn/security/advisories/GHSA-w4cm-gvhj-cgw6
nvd.nist.gov/vuln/detail/CVE-2026-61814

Code Behaviors & Features

Detect and mitigate CVE-2026-61814 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →