GitHub Advisoryadvisory · Maven
GHSA-q8xj-8xg3-w432 Uncontrolled Resource Consumption in spray-json
HIGH
Official page ↗
- Aliases
- CVE-2018-18854
- Ecosystem
- Maven
- Packages
- io.spray:spray-json_2.12, io.spray:spray-json_2.11, io.spray:spray-json_2.10
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2020-06-16
Affected packages
• Maven io.spray:spray-json_2.12: < 1.3.5 → fixed in 1.3.5
• Maven io.spray:spray-json_2.11: < 1.3.5 → fixed in 1.3.5
• Maven io.spray:spray-json_2.10: < 1.3.5 → fixed in 1.3.5
Description
Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).
Related
Alias · CVE (1)
- CVE-2018-18854 Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic… vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness