HSEC-2023-0001

See a problem?
Import Source
https://github.com/haskell/security-advisories/blob/generated/osv-export/2023/HSEC-2023-0001.json
JSON Data
https://api.osv.dev/v1/vulns/HSEC-2023-0001
Aliases
Published
2025-11-14T14:45:34Z
Modified
2025-11-14T18:15:27.977121Z
Summary
Hash flooding vulnerability in aeson
Details

Hash flooding vulnerability in aeson

aeson was vulnerable to hash flooding (a.k.a. hash DoS). The issue is a consequence of the HashMap implementation from unordered-containers. It results in a denial of service through CPU consumption. This technique has been used in real-world attacks against a variety of languages, libraries and frameworks over the years.

Database specific 
{
    "repository": "https://github.com/haskell/security-advisories",
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export"
}
References

Affected packages

Hackage / aeson

Package

Name
aeson
Purl
pkg:hackage/aeson

Severity

  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.4.0.0
Fixed
2.0.1.0

Affected versions

0.*

0.4.0.0
0.4.0.1
0.5.0.0
0.6.0.0
0.6.0.1
0.6.0.2
0.6.1.0
0.6.2.0
0.6.2.1
0.7.0.0
0.7.0.1
0.7.0.2
0.7.0.3
0.7.0.4
0.7.0.5
0.7.0.6
0.8.0.0
0.8.0.1
0.8.0.2
0.8.1.0
0.8.1.1
0.9.0.0
0.9.0.1
0.10.0.0
0.11.0.0
0.11.1.0
0.11.1.1
0.11.1.2
0.11.1.3
0.11.1.4
0.11.2.0
0.11.2.1
0.11.3.0

1.*

1.0.0.0
1.0.1.0
1.0.2.0
1.0.2.1
1.1.0.0
1.1.1.0
1.1.2.0
1.2.0.0
1.2.1.0
1.2.2.0
1.2.3.0
1.2.4.0
1.3.0.0
1.3.1.0
1.3.1.1
1.4.0.0
1.4.1.0
1.4.2.0
1.4.3.0
1.4.4.0
1.4.5.0
1.4.6.0
1.4.7.0
1.4.7.1
1.5.0.0
1.5.1.0
1.5.2.0
1.5.3.0
1.5.4.0
1.5.4.1
1.5.5.0
1.5.5.1
1.5.6.0

2.*

2.0.0.0

Database specific

source

"https://github.com/haskell/security-advisories/blob/generated/osv-export/2023/HSEC-2023-0001.json"

osv

"https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2023/HSEC-2023-0001.json"

human_link

"https://github.com/haskell/security-advisories/tree/main/advisories/published/2023/HSEC-2023-0001.md"