CVE-2018-18854

HIGH7.5EPSS 0.84%

Uncontrolled Resource Consumption in spray-json

Published: 11/9/2018Modified: 11/8/2023

Description

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).

Affected packages (3)

Maven/io.spray:spray-json_2.10from 0, < 1.3.5
Maven/io.spray:spray-json_2.11from 0, < 1.3.5
Maven/io.spray:spray-json_2.12from 0, < 1.3.5

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (4)

ADVISORYhttps://github.com/advisories/GHSA-q8xj-8xg3-w432
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-18854
PATCHhttps://github.com/spray/spray-jso
WEBhttps://github.com/spray/spray-json/issues/277