Uncontrolled Resource Consumption in Spray JSON

2022-06-2823:23:20

CWE-400

GitHub Advisory Database

github.com

resource consumption

spray json

stackoverflowexceptions

parsers

parsing state

JSON

Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently “open” parsing state is kept on the stack.

Affected configurations

Vulners

Node

io.sprayspray-jsonRange<1.3.5

VendorProductVersionCPE
io.sprayspray-json*cpe:2.3:a:io.spray:spray-json:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
io.spray	spray-json	*	cpe:2.3:a:io.spray:spray-json::::::::

References

github.com/advisories/GHSA-ww3v-6xjf-jv28

github.com/spray/spray-json/pull/284

security.snyk.io/vuln/SNYK-JAVA-IOSPRAY-72601

JSON

Related for GHSA-WW3V-6XJF-JV28