CVE-2018-18853: Uncontrolled Resource Consumption in spray-json
Summary
CVE-2018-18853: Uncontrolled Resource Consumption in spray-json when parsing decimal digit fields. Affects io.spray:spray-json_2.12 versions < 1.3.5. Fixed in 1.3.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spray-json package is a JSON library for Scala that provides a lightweight and efficient way to parse and manipulate JSON data. It is commonly used in Maven projects. This vulnerability affects versions 0 through 1.3.4 of the spray-json library. The library is vulnerable to a denial of service attack due to uncontrolled resource consumption during the parsing of a field composed of many decimal digits.
Vulnerability Detail
The vulnerability in spray-json allows remote attackers to cause a denial of service by exploiting the algorithmic complexity of parsing decimal digit fields. By sending a specially crafted JSON payload with a field containing a large number of decimal digits, an attacker can cause the parsing process to consume excessive resources, leading to a denial of service condition. This vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: 1.3.6 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to a fixed version of the spray-json library to mitigate the risk.
Conclusion
The uncontrolled resource consumption vulnerability in the spray-json library can be exploited by remote attackers to cause a denial of service. To mitigate this risk, it is recommended to upgrade to version 1.3.5 or later of the library. There is no known workaround for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.spray:spray-json_2.12 →
FAQ
This vulnerability can be exploited by remote attackers to cause a denial of service, potentially leading to service disruption or unavailability.
Versions 0 through 1.3.4 of the spray-json library are affected by this vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to a fixed version of the spray-json library is necessary.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply enter your pom.xml file and the playground will analyze it for open-source vulnerabilities, including this one.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for io.spray:spray-json_2.12.
