Skip to content
OpenAdvisories
Medium CVE-2018-18855 GHSA-ww3v-6xjf-jv28

Uncontrolled Resource Consumption in Spray JSON

Published Jun 28, 2022 · Updated Sep 30, 2025 · Assigned by GHSA

Package: io.spray:spray-json_2.10 Package: io.spray:spray-json_2.11 Package: io.spray:spray-json_2.11.0-RC4 Package: io.spray:spray-json_2.12 Package: io.spray:spray-json_2.12.0-M3 Package: io.spray:spray-json_2.12.0-M5 Package: io.spray:spray-json_2.12.0-RC1 Package: io.spray:spray-json_2.12.0-RC2 Package: io.spray:spray-json_2.13.0-M2 Package: io.spray:spray-json_2.13.0-M4 Package: io.spray:spray-json_2.13.0-M5 Package: io.spray:spray-json_2.9.3 Ecosystem: Maven

Description

Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.spray:spray-json_2.10 < 1.3.5 1.3.5 GHSA-ww3v-6xjf-jv28
Maven io.spray:spray-json_2.11 < 1.3.5 1.3.5 GHSA-ww3v-6xjf-jv28
Maven io.spray:spray-json_2.11.0-RC4 all versions — GHSA-ww3v-6xjf-jv28
Maven io.spray:spray-json_2.12 < 1.3.5 1.3.5 GHSA-ww3v-6xjf-jv28
Maven io.spray:spray-json_2.12.0-M3 all versions — GHSA-ww3v-6xjf-jv28
Maven io.spray:spray-json_2.12.0-M5 all versions — GHSA-ww3v-6xjf-jv28
Maven io.spray:spray-json_2.12.0-RC1 all versions — GHSA-ww3v-6xjf-jv28
Maven io.spray:spray-json_2.12.0-RC2 all versions — GHSA-ww3v-6xjf-jv28
Maven io.spray:spray-json_2.13.0-M2 all versions — GHSA-ww3v-6xjf-jv28
Maven io.spray:spray-json_2.13.0-M4 all versions — GHSA-ww3v-6xjf-jv28
Maven io.spray:spray-json_2.13.0-M5 < 1.3.5 1.3.5 GHSA-ww3v-6xjf-jv28
Maven io.spray:spray-json_2.9.3 all versions — GHSA-ww3v-6xjf-jv28

References