CVE-2026-61814

Name of the Vulnerable Software and Affected Versions Jawn versions prior to 1.7.0

Description The AsyncParser component can perform quadratic work when a single JSON token is delivered across many small chunks, as each absorb() call rescans the incomplete token from the beginning. A remote attacker controlling untrusted JSON input and chunk sizes can exhaust CPU resources, leading to a denial of service.

Recommendations Update to version 1.7.0.