This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution existsUpgrade jackson-dataformat-cbor | May 15, 2025 | Feb 18, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 34429365 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0. | Jul 25, 2022 | Feb 18, 2021 |
| Suse | — | Upgrade jackson-dataformat-smileUpgrade jackson-core-javadocUpgrade jackson-dataformats-binary-javadocUpgrade jackson-bomUpgrade jackson-dataformat-cborUpgrade jackson-coreUpgrade jackson-dataformats-binaryUpgrade jackson-databindUpgrade jackson-annotationsUpgrade jackson-annotations-javadocUpgrade jackson-databind-javadoc | Aug 9, 2024 | Feb 18, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Feb 18, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub