Skip to content
OpenAdvisories

Vendor

typelevel

6 known vulnerabilities.

typelevel at a glance

Last 12 months
2
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 2 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202620
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202510
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

jawn 3 fs2 2 grackle 1
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 7.5
    CVE-2026-59990

    Jawn: Uncontrolled nesting depth in JSON parser

    Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhauste…

    typelevel jawn jawn org.typelevel:jawn-parser_2.13 Debian Ubuntu Maven
  • High 7.5
    CVE-2026-61814

    Jawn: Quadratic parsing effort in AsyncParser

    Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who contro…

    typelevel org.typelevel jawn jawn-parser_2.13 Debian Ubuntu Maven
  • Medium 5.3
    CVE-2025-58369

    fs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite side

    fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vulnerable to denial of service attacks though TLS sessions using fs2-io on the JVM using the fs2.io.net…

    typelevel fs2 co.fs2:fs2-io_2.12 co.fs2:fs2-io_2.13 Maven
  • High 7.5
    CVE-2023-50730

    Grackle has StackOverflowError in GraphQL query processing

    Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn't chec…

    typelevel grackle org.typelevel:grackle-core_native0.4_3 edu.gemini:gsp-graphql-core_3 Maven
  • Critical 9.1
    CVE-2022-31183

    mTLS client verification is skipped in fs2 on Node.js

    fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = true` is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerabi…

    typelevel fs2 co.fs2:fs2-io_3 co.fs2:fs2-io_2.12 Maven
  • Medium 5.9
    CVE-2022-21653

    Hash collision in typelevel jawn

    Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applicat…

    typelevel jawn org.typelevel:jawn-parser_2.12 org.typelevel:jawn-parser_3 Ubuntu Maven