Jawn is an open source JSON parser that accepts arbitrarily deep JSON structures without a depth limit. If a remote attacker supplies a deeply nested array or object, the parser consumes excessive heap space until the Java Virtual Machine exhausts its memory, raising a java.lang.OutOfMemoryError. The error propagates as a fatal Scala error that is not normally caught by standard error handling, causing the entire application to terminate and resulting in denial of service. The weakness is an example of uncontrolled resource consumption (CWE‑770).

The vulnerability affects all versions of the typelevel:jawn JSON parser before release 1.7.0. Applications that integrate these older Jawn versions and accept untrusted JSON input are susceptible.

The CVSS score of 7.5 reflects significant impact for affected deployments. Although EPSS data is unavailable, the lack of a known exploit in the CISA KEV catalog suggests the attack is not yet widely documented, but the inherent nature of the flaw means it could be leveraged by an attacker who can deliver JSON to the parser. An attacker can trigger the vulnerability by submitting a heavily nested JSON document, causing heap exhaustion and a fatal error that leads to service disruption.