Uncontrolled Resource Consumption in Spray JSON · CVE-2018-18855 · GitHub Advisory Database · GitHub

Uncontrolled Resource Consumption in Spray JSON

Moderate severity GitHub Reviewed Published Jun 28, 2022 to the GitHub Advisory Database • Updated Sep 30, 2025

Package

io.spray:spray-json_2.10 (Maven)

Affected versions

< 1.3.5

Patched versions

1.3.5

io.spray:spray-json_2.11 (Maven)

< 1.3.5

1.3.5

io.spray:spray-json_2.11.0-RC4 (Maven)

< 1.3.5

None

io.spray:spray-json_2.12 (Maven)

< 1.3.5

1.3.5

io.spray:spray-json_2.12.0-M3 (Maven)

< 1.3.5

None

io.spray:spray-json_2.12.0-M5 (Maven)

< 1.3.5

None

io.spray:spray-json_2.12.0-RC1 (Maven)

< 1.3.5

None

io.spray:spray-json_2.12.0-RC2 (Maven)

< 1.3.5

None

io.spray:spray-json_2.13.0-M2 (Maven)

< 1.3.5

None

io.spray:spray-json_2.13.0-M4 (Maven)

< 1.3.5

None

io.spray:spray-json_2.13.0-M5 (Maven)

< 1.3.5

1.3.5

io.spray:spray-json_2.9.3 (Maven)

< 1.3.5

None

Description

Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.

References

Published to the GitHub Advisory Database Jun 28, 2022

Reviewed Jun 28, 2022

Last updated Sep 30, 2025