jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade apache-commons-collectionsUpgrade javassistUpgrade pki-jackson-module-jaxb-annotationsUpgrade fasterxml-oss-parentUpgrade jakarta-commons-httpclientUpgrade pki-jackson-coreUpgrade apache-commons-netUpgrade xsomUpgrade pki-jackson-jaxrs-json-providerUpgrade pki-jackson-databindUpgrade pki-jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade jackson-parentUpgrade relaxngDatatypeUpgrade xalan-j2Upgrade jackson-annotationsUpgrade glassfish-jaxb-coreUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-engineUpgrade jackson-coreUpgrade bea-stax-apiUpgrade stax-exUpgrade xml-commons-resolverUpgrade velocityUpgrade javassist-javadocUpgrade jackson-bomUpgrade xml-commons-apisUpgrade xmlstreambufferUpgrade xerces-j2Upgrade jackson-databindUpgrade pki-jackson-annotationsUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-txw2Upgrade jackson-modules-baseUpgrade glassfish-fastinfoset | Aug 11, 2025 | Jul 30, 2025 |
| Amazon Linux Ami 2 | — | Upgrade jackson-javadocUpgrade jackson | May 20, 2026 | May 20, 2026 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Jan 21, 2026 | Jan 20, 2026 |
| Debian | — | Upgrade jackson-core | Jun 27, 2025 | Jun 25, 2025 |
| Oracle_linux | — | Upgrade pki-jackson-jaxrs-providersUpgrade pki-jackson-databindUpgrade pki-jackson-coreUpgrade stax-exUpgrade slf4j-jdk14Upgrade pki-servlet-engineUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-collectionsUpgrade bea-stax-apiUpgrade jackson-parentUpgrade slf4jUpgrade velocityUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-coreUpgrade pki-jackson-jaxrs-json-providerUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade jackson-jaxrs-json-providerUpgrade pki-jackson-module-jaxb-annotationsUpgrade jackson-databindUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-txw2Upgrade xerces-j2Upgrade relaxngDatatypeUpgrade fasterxml-oss-parentUpgrade xml-commons-resolverUpgrade javassist-javadocUpgrade pki-jackson-annotationsUpgrade jackson-bomUpgrade jackson-annotationsUpgrade jackson-coreUpgrade apache-commons-netUpgrade xalan-j2Upgrade xmlstreambufferUpgrade xsomUpgrade jackson-modules-baseUpgrade xml-commons-apis | Aug 1, 2025 | Jun 25, 2025 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Jun 26, 2025 | Jun 25, 2025 |
| Redhat_linux | — | Upgrade pki-jackson-databindUpgrade xml-commons-apisUpgrade pki-jackson-annotationsUpgrade jackson-parentUpgrade pki-jackson-coreUpgrade javassistUpgrade jackson-annotationsUpgrade apache-commons-netUpgrade apache-commons-langUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade pki-jackson-jaxrs-json-providerUpgrade pki-jackson-module-jaxb-annotationsUpgrade slf4jUpgrade xalan-j2Upgrade xsomUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade fasterxml-oss-parentUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade jackson-bomUpgrade xmlstreambufferUpgrade pki-servlet-engineUpgrade bea-stax-apiUpgrade jackson-coreUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade pki-jackson-jaxrs-providersUpgrade jackson-modules-baseNo solution existsUpgrade velocity | Jul 9, 2025 | Jun 25, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.5Upgrade Splunk Enterprise to version 9.3.7Upgrade Splunk Enterprise to version 10.0.1Upgrade Splunk Enterprise to version 9.2.9 | Nov 12, 2025 | Jun 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub