jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade slf4j-jdk14Upgrade relaxngDatatypeUpgrade jackson-jaxrs-providersUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade xerces-j2Upgrade xsomUpgrade pki-jackson-databindUpgrade jackson-coreUpgrade jackson-annotationsUpgrade slf4jUpgrade apache-commons-netUpgrade jackson-bomUpgrade xml-commons-apisUpgrade xalan-j2Upgrade xml-commons-resolverUpgrade fasterxml-oss-parentUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade velocityUpgrade jackson-modules-baseUpgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade javassistUpgrade bea-stax-apiUpgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-collectionsUpgrade jackson-parentUpgrade glassfish-jaxb-coreUpgrade javassist-javadoc | May 15, 2023 | Mar 11, 2022 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 14, 2024 | Oct 17, 2023 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Centos_linux | — | Upgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-databindUpgrade pki-jackson-coreUpgrade pki-jackson-jaxrs-providersUpgrade pki-jackson-annotationsUpgrade pki-jackson-jaxrs-json-provider | May 15, 2023 | Mar 11, 2022 |
| Debian | — | Upgrade jackson-databind | May 4, 2022 | Mar 11, 2022 |
| Freebsd | — | Upgrade kafka | Feb 6, 2023 | Feb 4, 2023 |
| Oracle Missing Cpu Oct 2022 | — | Apply the October 2022 Critical Patch Update (CPU) for Oracle Database | Oct 26, 2022 | Mar 11, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34429365 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0. | Jul 25, 2022 | Mar 11, 2022 |
| Oracle_linux | — | Upgrade idm-jssUpgrade python3-idm-pkiUpgrade idm-pki-caUpgrade velocityUpgrade jackson-bomUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade jackson-modules-baseUpgrade apache-commons-collectionsUpgrade idm-ldapjdk-javadocUpgrade xml-commons-resolverUpgrade idm-ldapjdkUpgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-engineUpgrade pki-jackson-module-jaxb-annotationsUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade idm-pki-kraUpgrade bea-stax-apiUpgrade stax-exUpgrade fasterxml-oss-parentUpgrade idm-jss-javadocUpgrade idm-pki-acmeUpgrade pki-jackson-coreUpgrade xerces-j2Upgrade pki-jackson-annotationsUpgrade pki-jackson-jaxrs-providersUpgrade jakarta-commons-httpclientUpgrade idm-pki-base-javaUpgrade glassfish-jaxb-apiUpgrade idm-pki-symkeyUpgrade idm-pki-baseUpgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade slf4jUpgrade relaxngDatatypeUpgrade idm-tomcatjssUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade pki-jackson-databindUpgrade glassfish-fastinfosetUpgrade xsomUpgrade xalan-j2Upgrade resteasyUpgrade jackson-coreUpgrade jackson-parentUpgrade resteasy-javadocUpgrade pki-jackson-jaxrs-json-providerUpgrade idm-pki-toolsUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade glassfish-jaxb-txw2Upgrade idm-pki-serverUpgrade javassist-javadocUpgrade apache-commons-net | May 17, 2023 | Aug 13, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 11, 2022 |
| Redhat_linux | — | Upgrade idm-pki-toolsUpgrade jackson-annotationsUpgrade jackson-jaxrs-json-providerUpgrade xerces-j2Upgrade apache-commons-langUpgrade xml-commons-apisUpgrade resteasy-javadocUpgrade glassfish-fastinfosetUpgrade relaxngDatatypeUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade pki-jackson-annotationsUpgrade idm-pki-baseUpgrade pki-servlet-engineUpgrade jackson-module-jaxb-annotationsUpgrade idm-pki-acmeUpgrade idm-jss-debuginfoUpgrade pki-jackson-jaxrs-json-providerUpgrade xsomUpgrade idm-pki-kraUpgrade xmlstreambufferUpgrade idm-pki-tools-debuginfoUpgrade idm-pki-symkey-debuginfoUpgrade slf4jUpgrade idm-pki-base-javaUpgrade resteasyUpgrade idm-tomcatjssUpgrade jackson-databindUpgrade idm-ldapjdk-javadocUpgrade xalan-j2Upgrade jss-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-apiUpgrade apache-commons-netUpgrade pki-core-debugsourceUpgrade xml-commons-resolverUpgrade idm-pki-symkeyUpgrade pki-jackson-module-jaxb-annotationsUpgrade python3-idm-pkiUpgrade slf4j-jdk14Upgrade idm-pki-caUpgrade fasterxml-oss-parentUpgrade idm-jssUpgrade bea-stax-apiUpgrade pki-jackson-coreUpgrade idm-pki-serverUpgrade jackson-modules-baseUpgrade idm-jss-javadocUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade idm-ldapjdkUpgrade javassist-javadocUpgrade jackson-parentUpgrade pki-jackson-jaxrs-providersUpgrade stax-exUpgrade pki-core-debuginfoUpgrade pki-jackson-databindUpgrade apache-commons-collectionsUpgrade jackson-bomUpgrade javassist | May 15, 2023 | Mar 11, 2022 |
| Rocky_linux | — | Upgrade idm-pki-symkeyUpgrade idm-jssUpgrade idm-jss-javadocUpgrade idm-pki-toolsUpgrade idm-pki-symkey-debuginfoUpgrade idm-jss-debuginfoUpgrade idm-pki-tools-debuginfoUpgrade pki-core-debuginfoUpgrade pki-core-debugsourceUpgrade jss-debugsource | Jun 17, 2024 | Mar 11, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.12Upgrade Splunk Enterprise to version 8.2.9Upgrade Splunk Enterprise to version 9.0.2 | Sep 30, 2025 | Mar 11, 2022 |
| Suse | — | Upgrade jackson-annotationsUpgrade jackson-databindUpgrade jackson-coreUpgrade jackson-dataformats-binaryUpgrade jackson-bomUpgrade jackson-core-javadocUpgrade jackson-dataformat-cborUpgrade jackson-databind-javadocUpgrade jackson-annotations-javadocUpgrade jackson-dataformats-binary-javadocUpgrade jackson-dataformat-smile | Aug 9, 2024 | Mar 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub