{"id":"GHSA-vc89-hccf-rq55","summary":"Hash collision in typelevel jawn","details":"### Impact\n\nExtenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack.  Most applications do not implement these traits directly, but inherit from a library:\n\nAffected implementations include:\n* `org.http4s` :: `http4s-play-json`\n* `org.typelevel :: jawn-ast` (\u003c 0.8.0)\n* `org.typelevel :: jawn-play` (discontinued)\n* `org.typelevel :: jawn-rojoma` (discontinued)\n* `org.typelevel :: jawn-spray` (discontinued)\n\nUnaffected implementations include:\n* `io.argonaut :: argonaut-jawn`\n* `io.circe :: circe-parser`\n* `org.typelevel :: jawn-ast` (\u003e= 0.8.0)\n* `org.typelevel :: jawn-json4s` (discontinued)\n* `org.typelevel :: jawn-argonaut` (discontinued)\n\n### Patches\n\n`jawn-parser-1.3.2` fixes the issue.\n\n### Workarounds\n\nOverride `objectContext()` to use a collision-safe collection.  See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.\n\n### References\n\n* https://github.com/typelevel/jawn/pull/390\n\n### Credits\n\n* @kag0, for the report and the patch\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)\n* E-mail a maintainer:\n  * [@rossabaker](mailto:ross@rossabaker.com)","aliases":["CVE-2022-21653"],"modified":"2025-12-16T22:56:31.776825Z","published":"2022-01-06T23:48:35Z","database_specific":{"github_reviewed_at":"2022-01-06T20:19:30Z","nvd_published_at":"2022-01-05T21:15:00Z","cwe_ids":["CWE-326","CWE-400"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/typelevel/jawn/security/advisories/GHSA-vc89-hccf-rq55"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21653"},{"type":"WEB","url":"https://github.com/typelevel/jawn/pull/390"},{"type":"PACKAGE","url":"https://github.com/typelevel/jawn"}],"affected":[{"package":{"name":"org.typelevel:jawn-parser_0.25","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_0.25"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}},{"package":{"name":"org.typelevel:jawn-parserg","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parserg"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json","last_known_affected_version_range":"\u003c 1.3.2"}},{"package":{"name":"org.typelevel:jawn-parser_0.27","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_0.27"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0","1.0.1","1.0.2"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}},{"package":{"name":"org.typelevel:jawn-parser_2.10","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_2.10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.0","0.14.1"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}},{"package":{"name":"org.typelevel:jawn-parser_2.11","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_2.11"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.0","0.14.1","0.14.2","0.14.3","1.0.0-RC1","1.0.0-RC2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json","last_known_affected_version_range":"\u003c 1.3.2"}},{"package":{"name":"org.typelevel:jawn-parser_2.12","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}],"versions":["0.14.0","0.14.1","0.14.2","0.14.3","1.0.0","1.0.0-RC1","1.0.0-RC2","1.0.0-RC3","1.0.0-RC4","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}},{"package":{"name":"org.typelevel:jawn-parser_2.13","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}],"versions":["0.14.2","0.14.3","1.0.0","1.0.0-RC1","1.0.0-RC2","1.0.0-RC3","1.0.0-RC4","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}},{"package":{"name":"org.typelevel:jawn-parser_2.13.0-M5","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_2.13.0-M5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.0","0.14.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json","last_known_affected_version_range":"\u003c 1.3.2"}},{"package":{"name":"org.typelevel:jawn-parser_2.13.0-RC1","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_2.13.0-RC1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.2"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}},{"package":{"name":"org.typelevel:jawn-parser_2.13.0-RC2","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_2.13.0-RC2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.2"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}},{"package":{"name":"org.typelevel:jawn-parser_2.13.0-RC3","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_2.13.0-RC3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json","last_known_affected_version_range":"\u003c 1.3.2"}},{"package":{"name":"org.typelevel:jawn-parser_3","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}],"versions":["1.1.2","1.2.0","1.3.0","1.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}},{"package":{"name":"org.typelevel:jawn-parser_3.0.0-M1","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_3.0.0-M1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1","1.0.2"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}},{"package":{"name":"org.typelevel:jawn-parser_3.0.0-M2","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_3.0.0-M2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2","1.0.3"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}},{"package":{"name":"org.typelevel:jawn-parser_3.0.0-M3","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_3.0.0-M3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3","1.1.0"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}},{"package":{"name":"org.typelevel:jawn-parser_3.0.0-RC1","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_3.0.0-RC1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0","1.1.1"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}},{"package":{"name":"org.typelevel:jawn-parser_3.0.0-RC2","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_3.0.0-RC2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json","last_known_affected_version_range":"\u003c 1.3.2"}},{"package":{"name":"org.typelevel:jawn-parser_3.0.0-RC3","ecosystem":"Maven","purl":"pkg:maven/org.typelevel/jawn-parser_3.0.0-RC3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc89-hccf-rq55/GHSA-vc89-hccf-rq55.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}