GHSA-q8xj-8xg3-w432

Uncontrolled Resource Consumption in spray-json

Source: GitHub Advisory Database (reviewed) High CVE-2018-18854

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.spray:spray-json_2.12	< 1.3.5	1.3.5
Maven	io.spray:spray-json_2.11	< 1.3.5	1.3.5
Maven	io.spray:spray-json_2.10	< 1.3.5	1.3.5

Details

As written in the advisory (Markdown source, shown as plain text).

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-18854 advisory
https://github.com/spray/spray-json/issues/277 web
https://github.com/advisories/GHSA-q8xj-8xg3-w432 advisory
https://github.com/spray/spray-jso package