{"id":"GHSA-ww3v-6xjf-jv28","summary":"Uncontrolled Resource Consumption in Spray JSON","details":"Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently \"open\" parsing state is kept on the stack.","aliases":["CVE-2018-18855"],"modified":"2025-09-30T19:18:45.945287Z","published":"2022-06-28T23:23:20Z","database_specific":{"github_reviewed_at":"2022-06-28T23:23:20Z","nvd_published_at":null,"cwe_ids":["CWE-400"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/spray/spray-json/pull/284"},{"type":"PACKAGE","url":"https://github.com/spray/spray-json"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JAVA-IOSPRAY-72601"}],"affected":[{"package":{"name":"io.spray:spray-json_2.10","ecosystem":"Maven","purl":"pkg:maven/io.spray/spray-json_2.10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}],"versions":["1.2.5","1.2.6","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json"}},{"package":{"name":"io.spray:spray-json_2.11","ecosystem":"Maven","purl":"pkg:maven/io.spray/spray-json_2.11"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}],"versions":["1.2.6","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json"}},{"package":{"name":"io.spray:spray-json_2.11.0-RC4","ecosystem":"Maven","purl":"pkg:maven/io.spray/spray-json_2.11.0-RC4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.6"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json"}},{"package":{"name":"io.spray:spray-json_2.12","ecosystem":"Maven","purl":"pkg:maven/io.spray/spray-json_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}],"versions":["1.3.2","1.3.3","1.3.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json"}},{"package":{"name":"io.spray:spray-json_2.12.0-M3","ecosystem":"Maven","purl":"pkg:maven/io.spray/spray-json_2.12.0-M3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json"}},{"package":{"name":"io.spray:spray-json_2.12.0-M5","ecosystem":"Maven","purl":"pkg:maven/io.spray/spray-json_2.12.0-M5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json"}},{"package":{"name":"io.spray:spray-json_2.12.0-RC1","ecosystem":"Maven","purl":"pkg:maven/io.spray/spray-json_2.12.0-RC1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json"}},{"package":{"name":"io.spray:spray-json_2.12.0-RC2","ecosystem":"Maven","purl":"pkg:maven/io.spray/spray-json_2.12.0-RC2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json"}},{"package":{"name":"io.spray:spray-json_2.13.0-M2","ecosystem":"Maven","purl":"pkg:maven/io.spray/spray-json_2.13.0-M2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json"}},{"package":{"name":"io.spray:spray-json_2.13.0-M4","ecosystem":"Maven","purl":"pkg:maven/io.spray/spray-json_2.13.0-M4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json"}},{"package":{"name":"io.spray:spray-json_2.13.0-M5","ecosystem":"Maven","purl":"pkg:maven/io.spray/spray-json_2.13.0-M5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}],"versions":["1.3.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json"}},{"package":{"name":"io.spray:spray-json_2.9.3","ecosystem":"Maven","purl":"pkg:maven/io.spray/spray-json_2.9.3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.5","1.2.6"],"database_specific":{"last_known_affected_version_range":"\u003c 1.3.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json"}}],"schema_version":"1.9.0"}