high7.5
CVE-2018-18854
Uncontrolled Resource Consumption in spray-json
Impact
Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.spray:spray-json_2.12 | < 1.3.5 | 1.3.5 |
| maven | io.spray:spray-json_2.11 | < 1.3.5 | 1.3.5 |
| maven | io.spray:spray-json_2.10 | < 1.3.5 | 1.3.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lightbend | Spray-Json | through 1.3.4 |