search

spray / spray-json

A lightweight, clean and simple JSON implementation in Scala
Apache License 2.0
972 stars 190 forks source link

CVE-2018-18855 Denial of service for too deeply nested objects/arrays #286

Closed jrudolph closed 5 years ago

jrudolph commented 5 years ago

Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack. This also happens here.

This is already being fixed in #284 but recorded here for completeness.