HSEC-2023-0001
See a problem?- Import Source
- https://github.com/haskell/security-advisories/blob/generated/osv-export/2023/HSEC-2023-0001.json
- JSON Data
- https://api.osv.dev/v1/vulns/HSEC-2023-0001
- Aliases
- Published
- 2023-06-13T09:03:52Z
- Modified
- 2025-07-27T20:43:22.232130Z
- Summary
- Hash flooding vulnerability in aeson
- Details
-
Hash flooding vulnerability in aeson
aeson was vulnerable to hash flooding (a.k.a. hash DoS). The issue is a consequence of the HashMap implementation from unordered-containers. It results in a denial of service through CPU consumption. This technique has been used in real-world attacks against a variety of languages, libraries and frameworks over the years.
- Database specific
{ "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export", "home": "https://haskell.github.io/security-advisories", "repository": "https://github.com/haskell/security-advisories" }- References
Affected packages
Hackage / aeson
Package
- Name
- aeson
- Purl
- pkg:hackage/aeson
Severity
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Affected versions
0.*
0.4.0.0
0.4.0.1
0.5.0.0
0.6.0.0
0.6.0.1
0.6.0.2
0.6.1.0
0.6.2.0
0.6.2.1
0.7.0.0
0.7.0.1
0.7.0.2
0.7.0.3
0.7.0.4
0.7.0.5
0.7.0.6
0.8.0.0
0.8.0.1
0.8.0.2
0.8.1.0
0.8.1.1
0.9.0.0
0.9.0.1
0.10.0.0
0.11.0.0
0.11.1.0
0.11.1.1
0.11.1.2
0.11.1.3
0.11.1.4
0.11.2.0
0.11.2.1
0.11.3.0
1.*
1.0.0.0
1.0.1.0
1.0.2.0
1.0.2.1
1.1.0.0
1.1.1.0
1.1.2.0
1.2.0.0
1.2.1.0
1.2.2.0
1.2.3.0
1.2.4.0
1.3.0.0
1.3.1.0
1.3.1.1
1.4.0.0
1.4.1.0
1.4.2.0
1.4.3.0
1.4.4.0
1.4.5.0
1.4.6.0
1.4.7.0
1.4.7.1
1.5.0.0
1.5.1.0
1.5.2.0
1.5.3.0
1.5.4.0
1.5.4.1
1.5.5.0
1.5.5.1
1.5.6.0
2.*
2.0.0.0