CVE-2026-66648
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Unauthenticated Privilege Escalation in Jawn versions up to 1.4.2. An attacker can gain elevated privileges without authentication.
Risk Assessment
Potential takeover of admin accounts and full system control.
Recommendation
Update Jawn to a version newer than 1.4.2 that includes the fix.
Other vulnerabilities in Jawn
See all- CVE-2026-61814High
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.
- CVE-2026-59990High
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.
Original NVD description (English source)
Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS