# Aeson / text-iso8601 have a vulnerability, let's update bounds

**URL:** <https://discourse.haskell.org/t/aeson-text-iso8601-have-a-vulnerability-lets-update-bounds/14627>\
**Category:** Announcements\
**Created:** [August 29, 2026, 10:02am UTC](https://discourse.haskell.org/t/aeson-text-iso8601-have-a-vulnerability-lets-update-bounds/14627 "2026-08-29T10:02:33Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Lysxia](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/lysxia/32/2916_2.png) [@Lysxia](https://discourse.haskell.org/u/Lysxia)\
**Post date:** [August 29, 2026, 1:33pm UTC](https://discourse.haskell.org/t/aeson-text-iso8601-have-a-vulnerability-lets-update-bounds/14627/4 "2026-08-29T13:33:48Z")

</div>

I’ve released the backports:

- [text-iso8601-0.1.1.2](https://hackage.haskell.org/package/text-iso8601-0.1.1.2)
- [aeson-2.2.5.1](https://hackage.haskell.org/package/aeson-2.2.5.1)

These releases include only changes related to the DoS vulnerability.

The other changes in aeson 2.3 were quite minor as well, but non-security related, hence I’ve left them out of the backport just in case, and you can still upgrade aeson to 2.3 if you really need them.

---

_[View the full topic](https://discourse.haskell.org/t/aeson-text-iso8601-have-a-vulnerability-lets-update-bounds/14627)._