Jawn is an open‑source JSON parser. Before version 1.7.0 its AsyncParser performs a quadratic amount of work when a single JSON token is sent in many tiny chunks; each absorb call re‑scans from the beginning. An attacker controlling the JSON payload and its fragmentation can trigger repeated rescans, which consumes large amounts of CPU and leads to a denial‑of‑service in applications that use AsyncParser.

All versions of the Jawn Parser distributed under org.typelevel:jawn-parser_2.12, org.typelevel:jawn-parser_2.13, org.typelevel:jawn-parser_3 and the typelevel:jawn project that ship the parser before the release of 1.7.0 are affected. Upgrading to any version 1.7.0 or later removes the quadratic parsing behavior.

The CVSS score of 7.5 indicates a medium‑to‑high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered by remote on‑demand JSON input that can be individually controlled, the likely attack vector is remote network traffic or an API that accepts user data. An attacker can feed carefully crafted, fragment‑rich requests to exhaust server resources until legitimate traffic is denied.