GHSA-ww3v-6xjf-jv28Medium

Uncontrolled Resource Consumption in Spray JSON

Published
June 28, 2022
Last Modified
September 30, 2025

🔗 CVE IDs covered (1)

CVE-2018-18855 →

📋 Description

Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.

🎯 Affected products12

  • maven/io.spray:spray-json_2.10:< 1.3.5
  • maven/io.spray:spray-json_2.11:< 1.3.5
  • maven/io.spray:spray-json_2.11.0-RC4:< 1.3.5
  • maven/io.spray:spray-json_2.12:< 1.3.5
  • maven/io.spray:spray-json_2.12.0-M3:< 1.3.5
  • maven/io.spray:spray-json_2.12.0-M5:< 1.3.5
  • maven/io.spray:spray-json_2.12.0-RC1:< 1.3.5
  • maven/io.spray:spray-json_2.12.0-RC2:< 1.3.5
  • maven/io.spray:spray-json_2.13.0-M2:< 1.3.5
  • maven/io.spray:spray-json_2.13.0-M4:< 1.3.5
  • maven/io.spray:spray-json_2.13.0-M5:< 1.3.5
  • maven/io.spray:spray-json_2.9.3:< 1.3.5

🔗 References (3)