jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-coreUpgrade xsomUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade xalan-j2Upgrade xml-commons-apisUpgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade relaxngDatatypeUpgrade apache-commons-netUpgrade slf4jUpgrade fasterxml-oss-parentUpgrade jackson-annotationsUpgrade xmlstreambufferUpgrade jackson-jaxrs-providersUpgrade pki-jackson-databindUpgrade jackson-bomUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade glassfish-fastinfosetUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade bea-stax-apiUpgrade glassfish-jaxb-coreUpgrade jackson-module-jaxb-annotationsUpgrade jackson-modules-baseUpgrade pki-servlet-engineUpgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade jackson-parentUpgrade stax-exUpgrade javassist-javadocUpgrade velocity | May 15, 2023 | Mar 11, 2022 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 14, 2024 | Oct 17, 2023 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Centos_linux | — | Upgrade pki-jackson-jaxrs-json-providerUpgrade pki-jackson-jaxrs-providersUpgrade pki-jackson-annotationsUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-coreUpgrade pki-jackson-databind | May 15, 2023 | Mar 11, 2022 |
| Debian | — | Upgrade jackson-databind | May 4, 2022 | Mar 11, 2022 |
| Freebsd | — | Upgrade kafka | Feb 6, 2023 | Feb 4, 2023 |
| Oracle Missing Cpu Oct 2022 | — | Apply the October 2022 Critical Patch Update (CPU) for Oracle Database | Oct 26, 2022 | Mar 11, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34429365 for version 14.1.1.0.0. | Jul 25, 2022 | Mar 11, 2022 |
| Oracle_linux | — | Upgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade pki-jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade idm-pki-symkeyUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade idm-jss-javadocUpgrade idm-pki-base-javaUpgrade python3-idm-pkiUpgrade jackson-jaxrs-providersUpgrade javassistUpgrade idm-pki-caUpgrade jackson-bomUpgrade idm-pki-acmeUpgrade pki-jackson-jaxrs-providersUpgrade jakarta-commons-httpclientUpgrade velocityUpgrade xml-commons-resolverUpgrade jackson-modules-baseUpgrade idm-pki-kraUpgrade pki-jackson-coreUpgrade stax-exUpgrade xmlstreambufferUpgrade pki-jackson-module-jaxb-annotationsUpgrade bea-stax-apiUpgrade idm-pki-baseUpgrade xerces-j2Upgrade idm-ldapjdkUpgrade idm-ldapjdk-javadocUpgrade fasterxml-oss-parentUpgrade pki-servlet-engineUpgrade idm-jssUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade jackson-annotationsUpgrade idm-pki-toolsUpgrade pki-jackson-databindUpgrade xml-commons-apisUpgrade apache-commons-netUpgrade relaxngDatatypeUpgrade resteasy-javadocUpgrade pki-jackson-jaxrs-json-providerUpgrade glassfish-fastinfosetUpgrade jackson-parentUpgrade jackson-databindUpgrade idm-pki-serverUpgrade javassist-javadocUpgrade resteasyUpgrade jackson-coreUpgrade xsomUpgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade idm-tomcatjssUpgrade apache-commons-lang | May 17, 2023 | Aug 13, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 11, 2022 |
| Redhat_linux | — | Upgrade slf4j-jdk14Upgrade jackson-modules-baseUpgrade pki-jackson-module-jaxb-annotationsUpgrade xml-commons-resolverUpgrade idm-pki-symkeyUpgrade pki-jackson-jaxrs-providersUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2Upgrade python3-idm-pkiUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade stax-exUpgrade pki-jackson-databindUpgrade idm-pki-caUpgrade jackson-bomUpgrade idm-jss-javadocUpgrade apache-commons-collectionsUpgrade javassistUpgrade pki-core-debuginfoUpgrade idm-ldapjdkUpgrade jackson-parentUpgrade fasterxml-oss-parentUpgrade idm-jssUpgrade pki-core-debugsourceUpgrade pki-jackson-coreUpgrade idm-pki-serverUpgrade bea-stax-apiUpgrade velocityUpgrade idm-pki-tools-debuginfoUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade pki-jackson-jaxrs-json-providerUpgrade glassfish-jaxb-apiUpgrade jackson-coreUpgrade relaxngDatatypeUpgrade resteasyUpgrade idm-pki-baseUpgrade idm-ldapjdk-javadocUpgrade xmlstreambufferUpgrade pki-servlet-engineUpgrade jackson-databindUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade jss-debugsourceUpgrade idm-jss-debuginfoUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade idm-pki-acmeUpgrade slf4jUpgrade idm-tomcatjssUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade idm-pki-toolsUpgrade idm-pki-symkey-debuginfoUpgrade apache-commons-netUpgrade glassfish-jaxb-runtimeUpgrade idm-pki-kraUpgrade pki-jackson-annotationsUpgrade apache-commons-langUpgrade resteasy-javadocUpgrade xsomUpgrade idm-pki-base-java | May 15, 2023 | Mar 11, 2022 |
| Rocky_linux | — | Upgrade pki-core-debugsourceUpgrade idm-pki-tools-debuginfoUpgrade pki-core-debuginfoUpgrade idm-jss-debuginfoUpgrade idm-pki-symkey-debuginfoUpgrade jss-debugsourceUpgrade idm-jssUpgrade idm-pki-symkeyUpgrade idm-jss-javadocUpgrade idm-pki-tools | Jun 17, 2024 | Mar 11, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.9Upgrade Splunk Enterprise to version 9.0.2Upgrade Splunk Enterprise to version 8.1.12 | Sep 30, 2025 | Mar 11, 2022 |
| Suse | — | Upgrade jackson-coreUpgrade jackson-core-javadocUpgrade jackson-bomUpgrade jackson-annotationsUpgrade jackson-databindUpgrade jackson-dataformats-binaryUpgrade jackson-annotations-javadocUpgrade jackson-dataformat-cborUpgrade jackson-dataformat-smileUpgrade jackson-dataformats-binary-javadocUpgrade jackson-databind-javadoc | Aug 9, 2024 | Mar 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub