HSEC-2026-0007
Denial of Service and Memory Exhaustion in aeson
Published May 22, 2026 · updated Sep 16, 2026
# Denial of Service and Memory Exhaustion in aeson A Denial of Service (DoS) and memory exhaustion vulnerability was identified in the package. The vulnerability allows an attacker to exhaust server memory and crash the host process by supplying maliciously crafted JSON payloads. The vulnerability exists in 's function (located in ). The exponent bounds check only rejects large positive exponents ( ) but fails to reject arbitrarily large negative exponents. When an attacker sends a JSON number with a massive negative exponent (e.g., ), the value bypasses the check and flows into , which computes . For such a large negative exponent, produces a GMP Integer with approximately 1 billion decimal digits, causing immediate and severe memory exhaustion. Affected instances: * (including , , , etc.) * * ## Resolution The issue was resolved by introducing proper bounds checks: - now applies an absolute bounds check to both positive and negative exponents ( ). The fix first shipped in , and have been backported to the previous release series as . Users are strongly advised to update to the patched versions: * or later ## Acknowledgements The vulnerabilities were reported Nathan Walsh, and patched by Li-yao Xia.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 22, 2026 · OSV.dev
Detected
# Denial of Service and Memory Exhaustion in aeson A Denial of Service (DoS) and memory exhaustion vulnerability was identified in the package. The vulnerability allows an attacker to exhaust server memory and crash the host process by supplying maliciously crafted JSON payloads. The vulnerability exists in 's function (located in ). The exponent bounds check only rejects large positive exponents
Sep 16, 2026 · OSV.dev
Fix available
aeson fixed in 2.2.5.1; text-iso8601 fixed in 0.1.1.2
Sep 16, 2026 · OSV.dev
Fix available
aeson fixed in 2.2.5.1
Sep 16, 2026 · OSV.dev
Fix available
text-iso8601 fixed in 0.1.1.2
Sep 16, 2026 · OSV.dev
Updated
# Denial of Service and Memory Exhaustion in aeson A Denial of Service (DoS) and memory exhaustion vulnerability was identified in the package. The vulnerability allows an attacker to exhaust server memory and crash the host process by supplying maliciously crafted JSON payloads. The vulnerability exists in 's function (located in ). The exponent bounds check only rejects large positive exponents
Affected
- Hackage aeson0.12.0.0 → 2.2.5.1
- Hackage text-iso86010.1 → 0.1.1.2