Description
Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.spray:spray-json_2.10 | < 1.3.5 | 1.3.5 | GHSA-q8xj-8xg3-w432 |
| Maven | io.spray:spray-json_2.11 | < 1.3.5 | 1.3.5 | GHSA-q8xj-8xg3-w432 |
| Maven | io.spray:spray-json_2.12 | < 1.3.5 | 1.3.5 | GHSA-q8xj-8xg3-w432 |