Skip to content
OpenAdvisories
Medium · 5.9 CVE-2022-21653 EUVD-2022-0702GHSA-vc89-hccf-rq55

Hash collision in typelevel jawn

Published Jan 5, 2022 · Updated Apr 22, 2025 · Assigned by GitHub_M

Vendor: typelevel Product: jawn Package: jawn Package: org.typelevel:jawn-parser_0.25 Package: org.typelevel:jawn-parser_0.27 Package: org.typelevel:jawn-parser_2.10 Package: org.typelevel:jawn-parser_2.11 Package: org.typelevel:jawn-parser_2.12 Package: org.typelevel:jawn-parser_2.13 Package: org.typelevel:jawn-parser_2.13.0-M5 Package: org.typelevel:jawn-parser_2.13.0-RC1 Package: org.typelevel:jawn-parser_2.13.0-RC2 Package: org.typelevel:jawn-parser_2.13.0-RC3 Package: org.typelevel:jawn-parser_3 Package: org.typelevel:jawn-parser_3.0.0-M1 Package: org.typelevel:jawn-parser_3.0.0-M2 Package: org.typelevel:jawn-parser_3.0.0-M3 Package: org.typelevel:jawn-parser_3.0.0-RC1 Package: org.typelevel:jawn-parser_3.0.0-RC2 Package: org.typelevel:jawn-parser_3.0.0-RC3 Package: org.typelevel:jawn-parserg Ecosystem: Maven Ecosystem: Ubuntu

Description

Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.

Affected products

VendorProductAffectedFixed
typelevel jawn < 1.3.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 jawn No fix yet —
Ubuntu 26.04 LTS jawn No fix yet —
Ubuntu 25.10 jawn No fix yet —
Ubuntu 24.04 LTS jawn No fix yet —
Ubuntu 22.04 LTS jawn No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS jawn No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP3 jawn 0.14.1-bp153.2.3.1 openSUSE-SU-2022:0011-1
SUSE Package Hub 15 SP2 jawn 0.14.1-bp152.2.3.1 openSUSE-SU-2022:0045-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.3 jawn 0.14.1-bp153.2.3.1 openSUSE-SU-2022:0106-1, openSUSE-SU-2022:0011-1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.typelevel:jawn-parser_0.25 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_0.27 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_2.10 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_2.11 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_2.12 < 1.3.2 1.3.2 GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_2.13 < 1.3.2 1.3.2 GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_2.13.0-M5 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_2.13.0-RC1 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_2.13.0-RC2 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_2.13.0-RC3 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_3 < 1.3.2 1.3.2 GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_3.0.0-M1 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_3.0.0-M2 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_3.0.0-M3 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_3.0.0-RC1 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_3.0.0-RC2 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parser_3.0.0-RC3 all versions — GHSA-vc89-hccf-rq55
Maven org.typelevel:jawn-parserg all versions — GHSA-vc89-hccf-rq55

Advisories 3

References