GitHub Advisoryadvisory · Maven

GHSA-ww3v-6xjf-jv28 Uncontrolled Resource Consumption in Spray JSON

MEDIUM Published 2022-06-28 Modified 2025-09-30 Official page ↗
Aliases
CVE-2018-18855
Ecosystem
Maven
Packages
io.spray:spray-json_2.10, io.spray:spray-json_2.11, io.spray:spray-json_2.11.0-RC4, io.spray:spray-json_2.12, io.spray:spray-json_2.12.0-M3, io.spray:spray-json_2.12.0-M5, io.spray:spray-json_2.12.0-RC1, io.spray:spray-json_2.12.0-RC2, io.spray:spray-json_2.13.0-M2, io.spray:spray-json_2.13.0-M4, io.spray:spray-json_2.13.0-M5, io.spray:spray-json_2.9.3
Severity
Moderate
Weaknesses
CWE-400
Reviewed
2022-06-28

Affected packages

• Maven io.spray:spray-json_2.10: < 1.3.5 → fixed in 1.3.5 • Maven io.spray:spray-json_2.11: < 1.3.5 → fixed in 1.3.5 • Maven io.spray:spray-json_2.11.0-RC4: < 1.3.5 (no fix yet) • Maven io.spray:spray-json_2.12: < 1.3.5 → fixed in 1.3.5 • Maven io.spray:spray-json_2.12.0-M3: < 1.3.5 (no fix yet) • Maven io.spray:spray-json_2.12.0-M5: < 1.3.5 (no fix yet) • Maven io.spray:spray-json_2.12.0-RC1: < 1.3.5 (no fix yet) • Maven io.spray:spray-json_2.12.0-RC2: < 1.3.5 (no fix yet) • Maven io.spray:spray-json_2.13.0-M2: < 1.3.5 (no fix yet) • Maven io.spray:spray-json_2.13.0-M4: < 1.3.5 (no fix yet) • Maven io.spray:spray-json_2.13.0-M5: < 1.3.5 → fixed in 1.3.5 • Maven io.spray:spray-json_2.9.3: < 1.3.5 (no fix yet)

Description

Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References