jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade bea-stax-apiUpgrade javassistUpgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade pki-servlet-engineUpgrade jackson-parentUpgrade stax-exUpgrade apache-commons-collectionsUpgrade jackson-modules-baseUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-txw2Upgrade jackson-coreUpgrade xalan-j2Upgrade xerces-j2Upgrade xmlstreambufferUpgrade xml-commons-resolverUpgrade xml-commons-apisUpgrade relaxngDatatypeUpgrade jackson-jaxrs-providersUpgrade jackson-databindUpgrade jackson-bomUpgrade slf4jUpgrade pki-jackson-databindUpgrade apache-commons-netUpgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade slf4j-jdk14Upgrade fasterxml-oss-parent | May 15, 2023 | Mar 11, 2022 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 14, 2024 | Oct 17, 2023 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Centos_linux | — | Upgrade pki-jackson-annotationsUpgrade pki-jackson-jaxrs-providersUpgrade pki-jackson-jaxrs-json-providerUpgrade pki-jackson-databindUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-core | May 15, 2023 | Mar 11, 2022 |
| Debian | — | Upgrade jackson-databind | May 4, 2022 | Mar 11, 2022 |
| Freebsd | — | Upgrade kafka | Feb 6, 2023 | Feb 4, 2023 |
| Oracle Missing Cpu Oct 2022 | — | Apply the October 2022 Critical Patch Update (CPU) for Oracle Database | Oct 26, 2022 | Mar 11, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34429365 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0. | Jul 25, 2022 | Mar 11, 2022 |
| Oracle_linux | — | Upgrade jackson-coreUpgrade glassfish-fastinfosetUpgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade xalan-j2Upgrade resteasyUpgrade jackson-parentUpgrade jackson-databindUpgrade resteasy-javadocUpgrade idm-pki-serverUpgrade apache-commons-langUpgrade pki-jackson-databindUpgrade apache-commons-netUpgrade xml-commons-apisUpgrade idm-pki-toolsUpgrade relaxngDatatypeUpgrade idm-tomcatjssUpgrade jackson-annotationsUpgrade glassfish-jaxb-runtimeUpgrade idm-ldapjdk-javadocUpgrade slf4j-jdk14Upgrade idm-ldapjdkUpgrade idm-pki-baseUpgrade pki-jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-coreUpgrade idm-jss-javadocUpgrade idm-pki-base-javaUpgrade pki-jackson-annotationsUpgrade velocityUpgrade jackson-bomUpgrade jakarta-commons-httpclientUpgrade idm-jssUpgrade idm-pki-acmeUpgrade idm-pki-caUpgrade xml-commons-resolverUpgrade python3-idm-pkiUpgrade fasterxml-oss-parentUpgrade pki-servlet-engineUpgrade pki-jackson-jaxrs-providersUpgrade idm-pki-symkeyUpgrade jackson-modules-baseUpgrade apache-commons-collectionsUpgrade xerces-j2Upgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade xmlstreambufferUpgrade stax-exUpgrade idm-pki-kraUpgrade pki-jackson-coreUpgrade jackson-jaxrs-providersUpgrade javassist | May 17, 2023 | Aug 13, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 11, 2022 |
| Redhat_linux | — | Upgrade velocityUpgrade idm-pki-caUpgrade jackson-modules-baseUpgrade idm-pki-symkeyUpgrade idm-jss-javadocUpgrade xml-commons-resolverUpgrade resteasy-javadocUpgrade idm-pki-symkey-debuginfoUpgrade idm-pki-toolsUpgrade idm-pki-acmeUpgrade idm-tomcatjssUpgrade slf4jUpgrade jss-debugsourceUpgrade idm-jss-debuginfoUpgrade jackson-databindUpgrade idm-pki-tools-debuginfoUpgrade jackson-annotationsUpgrade xsomUpgrade apache-commons-langUpgrade jackson-jaxrs-json-providerUpgrade resteasyUpgrade apache-commons-netUpgrade xmlstreambufferUpgrade idm-pki-baseUpgrade jackson-module-jaxb-annotationsUpgrade pki-servlet-engineUpgrade idm-ldapjdk-javadocUpgrade pki-jackson-annotationsUpgrade xalan-j2Upgrade idm-pki-base-javaUpgrade jackson-coreUpgrade pki-jackson-jaxrs-json-providerUpgrade idm-pki-kraUpgrade xml-commons-apisUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providersUpgrade glassfish-fastinfosetUpgrade relaxngDatatypeUpgrade xerces-j2Upgrade pki-jackson-coreUpgrade idm-jssUpgrade bea-stax-apiUpgrade stax-exUpgrade python3-idm-pkiUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade pki-jackson-module-jaxb-annotationsUpgrade jackson-bomUpgrade slf4j-jdk14 | May 15, 2023 | Mar 11, 2022 |
| Rocky_linux | — | Upgrade idm-jss-debuginfoUpgrade pki-core-debuginfoUpgrade idm-pki-tools-debuginfoUpgrade jss-debugsourceUpgrade pki-core-debugsourceUpgrade idm-pki-symkey-debuginfoUpgrade idm-pki-toolsUpgrade idm-jssUpgrade idm-jss-javadocUpgrade idm-pki-symkey | Jun 17, 2024 | Mar 11, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.2Upgrade Splunk Enterprise to version 8.2.9Upgrade Splunk Enterprise to version 8.1.12 | Sep 30, 2025 | Mar 11, 2022 |
| Suse | — | Upgrade jackson-annotations-javadocUpgrade jackson-databind-javadocUpgrade jackson-dataformat-cborUpgrade jackson-dataformat-smileUpgrade jackson-dataformats-binary-javadocUpgrade jackson-annotationsUpgrade jackson-bomUpgrade jackson-dataformats-binaryUpgrade jackson-coreUpgrade jackson-core-javadocUpgrade jackson-databind | Aug 9, 2024 | Mar 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub