Denial of Service and Memory Exhaustion in aeson

A Denial of Service (DoS) and memory exhaustion vulnerability was identified in the aeson package. The vulnerability allows an attacker to exhaust server memory and crash the host process by supplying maliciously crafted JSON payloads.

The vulnerability exists in aeson's withBoundedScientific_ function (located in src/Data/Aeson/Types/FromJSON.hs). The exponent bounds check only rejects large positive exponents (exp10 > 1024) but fails to reject arbitrarily large negative exponents.

When an attacker sends a JSON number with a massive negative exponent (e.g., 1e-999999999), the value bypasses the check and flows into realToFrac, which computes fromRational . toRational. For such a large negative exponent, toRational produces a GMP Integer with approximately 1 billion decimal digits, causing immediate and severe memory exhaustion.

Affected FromJSON instances:

• Fixed a (including Centi, Pico, Nano, etc.)
• NominalDiffTime
• DiffTime

Resolution

The issue was resolved by introducing proper bounds checks:

• aeson now applies an absolute bounds check to both positive and negative exponents (abs exp10 > 1024).

The fix first shipped in aeson-2.3.0.0, and have been backported to the previous release series as aeson-2.2.5.1.

Users are strongly advised to update to the patched versions:

• aeson-2.2.5.1 or later

Acknowledgements

The vulnerabilities were reported Nathan Walsh, and patched by Li-yao Xia.