HSEC-2026-0007
Vulnerability from osv_haskell – Published: 2026-05-22 07:02 – Updated: 2026-05-22 07:02 – Source websiteDenial of Service and Memory Exhaustion in aeson
A Denial of Service (DoS) and memory exhaustion vulnerability was identified in the aeson package. The vulnerability allows an attacker to exhaust server memory and crash the host process by supplying maliciously crafted JSON payloads.
The vulnerability exists in aeson's withBoundedScientific_ function (located in src/Data/Aeson/Types/FromJSON.hs). The exponent bounds check only rejects large positive exponents (exp10 > 1024) but fails to reject arbitrarily large negative exponents.
When an attacker sends a JSON number with a massive negative exponent (e.g., 1e-999999999), the value bypasses the check and flows into realToFrac, which computes fromRational . toRational. For such a large negative exponent, toRational produces a GMP Integer with approximately 1 billion decimal digits, causing immediate and severe memory exhaustion.
Affected FromJSON instances:
Fixed a(includingCenti,Pico,Nano, etc.)NominalDiffTimeDiffTime
Resolution
The issue was resolved by introducing proper bounds checks:
aesonnow applies an absolute bounds check to both positive and negative exponents (abs exp10 > 1024).
The fix first shipped in aeson-2.3.0.0, and have been backported to the previous release series as aeson-2.2.5.1.
Users are strongly advised to update to the patched versions:
aeson-2.2.5.1or later
Acknowledgements
The vulnerabilities were reported Nathan Walsh, and patched by Li-yao Xia.
{
"affected": [
{
"database_specific": {
"human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2026/HSEC-2026-0007.md",
"osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2026/HSEC-2026-0007.json"
},
"package": {
"ecosystem": "Hackage",
"name": "aeson"
},
"ranges": [
{
"events": [
{
"introduced": "0.12.0.0"
},
{
"fixed": "2.2.5.1"
}
],
"type": "ECOSYSTEM"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
},
{
"database_specific": {
"human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2026/HSEC-2026-0007.md",
"osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2026/HSEC-2026-0007.json"
},
"package": {
"ecosystem": "Hackage",
"name": "text-iso8601"
},
"ranges": [
{
"events": [
{
"introduced": "0.1"
},
{
"fixed": "0.1.1.2"
}
],
"type": "ECOSYSTEM"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
],
"database_specific": {
"home": "https://github.com/haskell/security-advisories",
"osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
"repository": "https://github.com/haskell/security-advisories"
},
"details": "# Denial of Service and Memory Exhaustion in aeson\n\nA Denial of Service (DoS) and memory exhaustion vulnerability was identified in the `aeson` package. The vulnerability allows an attacker to exhaust server memory and crash the host process by supplying maliciously crafted JSON payloads.\n\nThe vulnerability exists in `aeson`\u0027s `withBoundedScientific_` function (located in `src/Data/Aeson/Types/FromJSON.hs`). The exponent bounds check only rejects large positive exponents (`exp10 \u003e 1024`) but fails to reject arbitrarily large negative exponents.\n\nWhen an attacker sends a JSON number with a massive negative exponent (e.g., `1e-999999999`), the value bypasses the check and flows into `realToFrac`, which computes `fromRational . toRational`. For such a large negative exponent, `toRational` produces a GMP Integer with approximately 1 billion decimal digits, causing immediate and severe memory exhaustion.\n\nAffected `FromJSON` instances:\n\n* `Fixed a` (including `Centi`, `Pico`, `Nano`, etc.)\n* `NominalDiffTime`\n* `DiffTime`\n\n## Resolution\n\nThe issue was resolved by introducing proper bounds checks:\n\n- `aeson` now applies an absolute bounds check to both positive and negative exponents (`abs exp10 \u003e 1024`).\n\nThe fix first shipped in `aeson-2.3.0.0`, and have been backported to the previous release series as `aeson-2.2.5.1`.\n\nUsers are strongly advised to update to the patched versions:\n\n* `aeson-2.2.5.1` or later\n\n## Acknowledgements\n\nThe vulnerabilities were reported Nathan Walsh, and patched by Li-yao Xia.\n",
"id": "HSEC-2026-0007",
"modified": "2026-05-22T07:02:58Z",
"published": "2026-05-22T07:02:58Z",
"references": [
{
"type": "FIX",
"url": "https://github.com/haskell/aeson/commit/42775f45ff8dad934d44617f6f38ee874e1c9df1"
},
{
"type": "FIX",
"url": "https://github.com/haskell/aeson/commit/b6fb54b11ebf3e499685c4eeb2714ead522252cc"
}
],
"schema_version": "1.5.0",
"summary": "Denial of Service and Memory Exhaustion in aeson"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.