Skip to content

Uncontrolled Resource Consumption in Spray JSON

Moderate severity GitHub Reviewed Published Jun 28, 2022 to the GitHub Advisory Database • Updated Jan 12, 2023

Package

maven io.spray:spray-json (Maven)

Affected versions

< 1.3.5

Patched versions

1.3.5

Description

Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.

References

Published to the GitHub Advisory Database Jun 28, 2022
Reviewed Jun 28, 2022
Last updated Jan 12, 2023

Severity

Moderate

Weaknesses

CVE ID

CVE-2018-18855

GHSA ID

GHSA-ww3v-6xjf-jv28

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.