CVE-2026-59990

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.

• CWE-770

• https://github.com/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04
• https://github.com/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed
• https://github.com/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b
• https://github.com/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214
• https://github.com/typelevel/jawn/releases/tag/v1.7.0
• https://github.com/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3

Published

Sep 23, 2026

Last Modified

Sep 23, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59982OpenEXR is the reference implementation and specification fo…7.1
• CVE-2026-59983OpenEXR is the reference implementation and specification fo…5.5
• CVE-2026-59984OpenEXR is the reference implementation and specification fo…5.5
• CVE-2026-59985OpenEXR is the reference implementation and specification fo…5.5
• CVE-2026-59989Phalcon is a high-performance, full-stack PHP framework. In …9.2
• CVE-2026-5999A vulnerability has been found in JeecgBoot up to 3.9.1. Thi…6.3
• CVE-2026-59991psd-tools is a Python package for working with Adobe Photosh…7.5
• CVE-2026-59992Tina is a headless content management system. Prior to next-…5.4
• CVE-2026-59995sftp in OpenSSH before 10.4 does not properly constrain the …5.4
• CVE-2026-59996scp in OpenSSH before 10.4 may place a file in the parent di…5.4
• CVE-2026-59997internal-sftp in sshd in OpenSSH before 10.4 recognizes only…5.4
• CVE-2026-59998sshd in OpenSSH before 10.4 has an undocumented security-rel…6.5