Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-59990, describes an uncontrolled nesting depth in the Jawn JSON parser, leading to a denial of service via java.lang.OutOfMemoryError. The provided patches clearly indicate that the fix involves introducing and enforcing a maxDepth limit within the recursive parsing functions.
Specifically, the rparse functions in both jawn.Parser and jawn.AsyncParser were identified as the core vulnerable components. These functions are responsible for recursively processing JSON structures. In the vulnerable versions (prior to 1.6.1), these functions would recurse indefinitely for deeply nested inputs, consuming excessive stack space and JVM heap, eventually leading to a crash.
The patches introduce a depth parameter to these rparse functions and add explicit checks (if (depth >= maxDepth)) to prevent recursion beyond a configurable limit. The absence of these checks and the depth parameter in the original versions of these functions is the root cause of the vulnerability. Therefore, jawn.Parser.rparse and jawn.AsyncParser.rparse are the precise functions that would appear in a runtime profile when this vulnerability is exploited, as they are the points of uncontrolled recursion.
jawn.Parser.rparseparser/shared/src/main/scala/jawn/Parser.scala
jawn.AsyncParser.rparseparser/shared/src/main/scala/jawn/AsyncParser.scala
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.typelevel:jawn-parser_2.12 | maven | <= 1.6.0 | 1.7.0 |
| org.typelevel:jawn-parser_2.13 | maven | <= 1.6.0 | 1.7.0 |
| org.typelevel:jawn-parser_3 | maven | <= 1.6.0 | 1.7.0 |