CVE-2026-59990

Name of the Vulnerable Software and Affected Versions Jawn versions prior to 1.7.0

Description Jawn parse methods allow arbitrarily deep JSON array and object nesting without a depth limit. A remote attacker can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted, triggering a java.lang.OutOfMemoryError. This is a fatal Scala error that is not typically handled by scala.util.Try or cats.effect.IO, resulting in a denial of service.

Recommendations Update to version 1.7.0 or later. Enforce an input size limit small enough to prevent the context stack from exhausting the heap. Pre-scan untrusted input and reject documents whose maximum delimiter nesting exceeds a threshold before processing them with the parser.