{
"id": "GHSA-vc89-hccf-rq55",
"aliases": [
"CVE-2022-21653"
],
"details": "### Impact\n\nExtenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library:\n\nAffected implementations include:\n* `org.http4s` :: `http4s-play-json`\n* `org.typelevel :: jawn-ast` (< 0.8.0)\n* `org.typelevel :: jawn-play` (discontinued)\n* `org.typelevel :: jawn-rojoma` (discontinued)\n* `org.typelevel :: jawn-spray` (discontinued)\n\nUnaffected implementations include:\n* `io.argonaut :: argonaut-jawn`\n* `io.circe :: circe-parser`\n* `org.typelevel :: jawn-ast` (>= 0.8.0)\n* `org.typelevel :: jawn-json4s` (discontinued)\n* `org.typelevel :: jawn-argonaut` (discontinued)\n\n### Patches\n\n`jawn-parser-1.3.2` fixes the issue.\n\n### Workarounds\n\nOverride `objectContext()` to use a collision-safe collection. See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.\n\n### References\n\n* https://github.com/typelevel/jawn/pull/390\n\n### Credits\n\n* @kag0, for the report and the patch\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)\n* E-mail a maintainer:\n * [@rossabaker](mailto:[email protected] )",
"summary": "Hash collision in typelevel jawn",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_0.25",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parserg",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_0.27",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_2.10",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_2.11",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_2.12",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_2.13",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_2.13.0-M5",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_2.13.0-RC1",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_2.13.0-RC2",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_2.13.0-RC3",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_3",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_3.0.0-M1",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_3.0.0-M2",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_3.0.0-M3",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_3.0.0-RC1",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_3.0.0-RC2",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.typelevel:jawn-parser_3.0.0-RC3",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 1.3.2"
}
}
],
"modified": "2025-12-16T22:29:13Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"published": "2022-01-06T23:48:35Z",
"references": [
{
"url": "https://github.com/typelevel/jawn/security/advisories/GHSA-vc89-hccf-rq55",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21653",
"type": "ADVISORY"
},
{
"url": "https://github.com/typelevel/jawn/pull/390",
"type": "WEB"
},
{
"url": "https://github.com/typelevel/jawn",
"type": "PACKAGE"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-326",
"CWE-400"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2022-01-05T21:15:00Z",
"github_reviewed_at": "2022-01-06T20:19:30Z"
}
}