A Denial of Service (DoS) and memory exhaustion vulnerability was identified in the aeson package. The vulnerability allows an attacker to exhaust server memory and crash the host process by supplying maliciously crafted JSON payloads.

The vulnerability exists in aeson's withBoundedScientific function (located in src/Data/Aeson/Types/FromJSON.hs). The exponent bounds check only rejects large positive exponents (exp10 > 1024) but fails to reject arbitrarily large negative exponents.

When an attacker sends a JSON number with a massive negative exponent (e.g., 1e-999999999), the value bypasses the check and flows into realToFrac, which computes fromRational . toRational. For such a large negative exponent, toRational produces a GMP Integer with approximately 1 billion decimal digits, causing immediate and severe memory exhaustion.

Affected FromJSON instances:

The issue was resolved by introducing proper bounds checks:

The fix first shipped in aeson-2.3.0.0, and have been backported to the previous release series as aeson-2.2.5.1.

Users are strongly advised to update to the patched versions:

The vulnerabilities were reported Nathan Walsh, and patched by Li-yao Xia.