{"action":"Upgrade org.typelevel:jawn-parser_3 to 1.7.0 or later.","affected":[{"fixed":"1.7.0","introduced":"0"}],"component":"org.typelevel:jawn-parser_3","cve_ids":["CVE-2026-59990"],"ecosystem":"Maven","epss":0.00615,"exploited":false,"fixed_versions":["1.7.0"],"ghsa_id":"GHSA-cc4v-rvgp-2pf3","id":"tcs_01M5N8S4EZ5C5GV910RWBAC80E","modified_at":"2026-09-23T21:30:04.437683237Z","published_at":"2026-09-23T21:23:54Z","references":["https://osv.dev/vulnerability/GHSA-cc4v-rvgp-2pf3","https://github.com/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3","https://github.com/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04","https://github.com/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed","https://github.com/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b","https://github.com/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214","https://github.com/typelevel/jawn","https://github.com/typelevel/jawn/releases/tag/v1.7.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cc4v-rvgp-2pf3#Maven/org.typelevel:jawn-parser_3","url":"https://osv.dev/vulnerability/GHSA-cc4v-rvgp-2pf3"}],"summary":"Jawn: Uncontrolled nesting depth in JSON parser"}