Denial of Service and Memory Exhaustion in aeson

A Denial of Service (DoS) and memory exhaustion vulnerability was identified in the aeson package. The vulnerability allows an attacker to exhaust server memory and crash the host process by supplying maliciously crafted JSON payloads.

The vulnerability exists in aeson's withBoundedScientific_ function (located in src/Data/Aeson/Types/FromJSON.hs). The exponent bounds check only rejects large positive exponents (exp10 > 1024) but fails to reject arbitrarily large negative exponents.

When an attacker sends a JSON number with a massive negative exponent (e.g., 1e-999999999), the value bypasses the check and flows into realToFrac, which computes fromRational . toRational. For such a large negative exponent, toRational produces a GMP Integer with approximately 1 billion decimal digits, causing immediate and severe memory exhaustion.

Affected FromJSON instances:

• Fixed a (including Centi, Pico, Nano, etc.)
• NominalDiffTime
• DiffTime

Resolution

The issue was resolved by introducing proper bounds checks:

• aeson now applies an absolute bounds check to both positive and negative exponents (abs exp10 > 1024).

The fix first shipped in aeson-2.3.0.0, and have been backported to the previous release series as aeson-2.2.5.1.

Users are strongly advised to update to the patched versions:

• aeson-2.2.5.1 or later

Acknowledgements

The vulnerabilities were reported Nathan Walsh, and patched by Li-yao Xia.

Info

Published

May 22, 2026

Modified

May 22, 2026

CAPECs

< none >

CWEs

400

Keywords

aeson, dos, memory-exhaustion, json

Aliases

< none >

Related

< none >

References

[FIX] https://github.com/haskell/aeson/commit/42775f45ff8dad934d44617f6f38ee874e1c9df1

[FIX] https://github.com/haskell/aeson/commit/b6fb54b11ebf3e499685c4eeb2714ead522252cc

Affected

@hackage/aeson

CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Versions

>=0.12.0.0 && <2.2.5.1

Declarations

< none >

Affected APIs

< none >

@hackage/text-iso8601

CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Versions

>=0.1 && <0.1.1.2

Declarations

< none >

Affected APIs

< none >