jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-txw2Upgrade jackson-bomUpgrade apache-commons-netUpgrade xml-commons-apisUpgrade xalan-j2Upgrade xml-commons-resolverUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade jackson-annotationsUpgrade slf4jUpgrade jackson-databindUpgrade xmlstreambufferUpgrade fasterxml-oss-parentUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade pki-jackson-databindUpgrade jackson-coreUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade jackson-module-jaxb-annotationsUpgrade pki-servlet-engineUpgrade bea-stax-apiUpgrade glassfish-fastinfosetUpgrade jackson-modules-baseUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade stax-exUpgrade jackson-parentUpgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade apache-commons-lang | May 15, 2023 | Mar 11, 2022 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 14, 2024 | Oct 17, 2023 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Centos_linux | — | Upgrade pki-jackson-coreUpgrade pki-jackson-databindUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-jaxrs-providersUpgrade pki-jackson-jaxrs-json-providerUpgrade pki-jackson-annotations | May 15, 2023 | Mar 11, 2022 |
| Debian | — | Upgrade jackson-databind | May 4, 2022 | Mar 11, 2022 |
| Freebsd | — | Upgrade kafka | Feb 6, 2023 | Feb 4, 2023 |
| Oracle Missing Cpu Oct 2022 | — | Apply the October 2022 Critical Patch Update (CPU) for Oracle Database | Oct 26, 2022 | Mar 11, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34429365 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0. | Jul 25, 2022 | Mar 11, 2022 |
| Oracle_linux | — | Upgrade jackson-coreUpgrade xsomUpgrade jackson-annotationsUpgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade idm-tomcatjssUpgrade idm-pki-toolsUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade javassist-javadocUpgrade idm-pki-serverUpgrade xml-commons-apisUpgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade apache-commons-netUpgrade xalan-j2Upgrade jackson-modules-baseUpgrade jackson-bomUpgrade idm-jssUpgrade velocityUpgrade pki-jackson-jaxrs-providersUpgrade idm-pki-symkeyUpgrade idm-pki-base-javaUpgrade idm-jss-javadocUpgrade glassfish-jaxb-coreUpgrade xml-commons-resolverUpgrade pki-jackson-coreUpgrade idm-pki-kraUpgrade stax-exUpgrade bea-stax-apiUpgrade xmlstreambufferUpgrade xerces-j2Upgrade fasterxml-oss-parentUpgrade idm-ldapjdk-javadocUpgrade idm-ldapjdkUpgrade glassfish-jaxb-runtimeUpgrade pki-jackson-module-jaxb-annotationsUpgrade idm-pki-baseUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade apache-commons-collectionsUpgrade pki-servlet-engineUpgrade idm-pki-caUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade idm-pki-acmeUpgrade python3-idm-pkiUpgrade pki-jackson-annotationsUpgrade jakarta-commons-httpclient | May 17, 2023 | Aug 13, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 11, 2022 |
| Redhat_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade xerces-j2Upgrade apache-commons-collectionsUpgrade pki-jackson-databindUpgrade javassistUpgrade apache-commons-netUpgrade resteasyUpgrade idm-pki-acmeUpgrade relaxngDatatypeUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade jackson-databindUpgrade xsomUpgrade jackson-annotationsUpgrade idm-jss-debuginfoUpgrade jss-debugsourceUpgrade idm-ldapjdk-javadocUpgrade glassfish-fastinfosetUpgrade pki-servlet-engineUpgrade xmlstreambufferUpgrade pki-jackson-annotationsUpgrade idm-pki-symkey-debuginfoUpgrade slf4jUpgrade apache-commons-langUpgrade idm-tomcatjssUpgrade idm-pki-baseUpgrade idm-pki-tools-debuginfoUpgrade idm-pki-toolsUpgrade resteasy-javadocUpgrade xalan-j2Upgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade idm-pki-kraUpgrade glassfish-jaxb-apiUpgrade pki-jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade idm-pki-base-javaUpgrade jackson-bomUpgrade pki-core-debuginfoUpgrade jackson-parentUpgrade pki-core-debugsourceUpgrade velocityUpgrade pki-jackson-module-jaxb-annotationsUpgrade stax-exUpgrade idm-pki-caUpgrade python3-idm-pki | May 15, 2023 | Mar 11, 2022 |
| Rocky_linux | — | Upgrade pki-core-debuginfoUpgrade idm-jss-debuginfoUpgrade pki-core-debugsourceUpgrade jss-debugsourceUpgrade idm-pki-symkey-debuginfoUpgrade idm-pki-tools-debuginfoUpgrade idm-pki-toolsUpgrade idm-pki-symkeyUpgrade idm-jssUpgrade idm-jss-javadoc | Jun 17, 2024 | Mar 11, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.9Upgrade Splunk Enterprise to version 9.0.2Upgrade Splunk Enterprise to version 8.1.12 | Sep 30, 2025 | Mar 11, 2022 |
| Suse | — | Upgrade jackson-annotations-javadocUpgrade jackson-dataformat-cborUpgrade jackson-dataformats-binary-javadocUpgrade jackson-dataformat-smileUpgrade jackson-databind-javadocUpgrade jackson-bomUpgrade jackson-dataformats-binaryUpgrade jackson-coreUpgrade jackson-databindUpgrade jackson-annotationsUpgrade jackson-core-javadoc | Aug 9, 2024 | Mar 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub