CVE-2018-18853

HIGH

Lightbend Spray spray-json < 1.3.4 - Denial of Service via Algorithmic Complexity in Decimal Digit Parsing

Title source: llm
STIX 2.1

Description

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of a field composed of many decimal digits.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/spray/spray-json/issues/278

Scores

CVSS v3 7.5
EPSS 0.0190
EPSS Percentile 77.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-400
Status published
Products (4)
io.spray/spray-json_2.10 0 - 1.3.5Maven
io.spray/spray-json_2.11 0 - 1.3.5Maven
io.spray/spray-json_2.12 0 - 1.3.5Maven
lightbend/spray-json < 1.3.4
Published Oct 31, 2018
Tracked Since Feb 18, 2026