jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-coreUpgrade xml-commons-resolverUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade jackson-bomUpgrade glassfish-jaxb-txw2Upgrade pki-jackson-databindUpgrade jackson-databindUpgrade slf4jUpgrade xsomUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade apache-commons-netUpgrade xmlstreambufferUpgrade jackson-annotationsUpgrade fasterxml-oss-parentUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade jackson-module-jaxb-annotationsUpgrade jackson-modules-baseUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade apache-commons-langUpgrade javassist-javadocUpgrade stax-exUpgrade jackson-parentUpgrade glassfish-fastinfosetUpgrade apache-commons-collectionsUpgrade javassistUpgrade glassfish-jaxb-coreUpgrade velocity | May 15, 2023 | Mar 11, 2022 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 14, 2024 | Oct 17, 2023 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Centos_linux | — | Upgrade pki-jackson-annotationsUpgrade pki-jackson-jaxrs-json-providerUpgrade pki-jackson-jaxrs-providersUpgrade pki-jackson-coreUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-databind | May 15, 2023 | Mar 11, 2022 |
| Debian | — | Upgrade jackson-databind | May 4, 2022 | Mar 11, 2022 |
| Freebsd | — | Upgrade kafka | Feb 6, 2023 | Feb 4, 2023 |
| Oracle Missing Cpu Oct 2022 | — | Apply the October 2022 Critical Patch Update (CPU) for Oracle Database | Oct 26, 2022 | Mar 11, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34429365 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0. | Jul 25, 2022 | Mar 11, 2022 |
| Oracle_linux | — | Upgrade glassfish-jaxb-coreUpgrade idm-pki-acmeUpgrade idm-jssUpgrade pki-jackson-jaxrs-providersUpgrade jackson-bomUpgrade idm-pki-base-javaUpgrade idm-jss-javadocUpgrade idm-ldapjdk-javadocUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-jaxrs-json-providerUpgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade slf4jUpgrade jackson-parentUpgrade xml-commons-apisUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade jackson-coreUpgrade xalan-j2Upgrade idm-pki-serverUpgrade javassist-javadocUpgrade idm-pki-symkeyUpgrade xerces-j2Upgrade xmlstreambufferUpgrade bea-stax-apiUpgrade stax-exUpgrade idm-pki-kraUpgrade jackson-jaxrs-providersUpgrade pki-jackson-coreUpgrade python3-idm-pkiUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade jackson-modules-baseUpgrade apache-commons-collectionsUpgrade fasterxml-oss-parentUpgrade xml-commons-resolverUpgrade slf4j-jdk14Upgrade idm-pki-baseUpgrade glassfish-jaxb-runtimeUpgrade jakarta-commons-httpclientUpgrade velocityUpgrade idm-ldapjdkUpgrade pki-jackson-annotationsUpgrade idm-pki-ca | May 17, 2023 | Aug 13, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 11, 2022 |
| Redhat_linux | — | Upgrade pki-jackson-jaxrs-json-providerUpgrade glassfish-jaxb-apiUpgrade jackson-coreUpgrade xalan-j2Upgrade jackson-annotationsUpgrade jackson-databindUpgrade resteasy-javadocUpgrade apache-commons-langUpgrade idm-pki-base-javaUpgrade slf4jUpgrade idm-pki-toolsUpgrade apache-commons-netUpgrade resteasyUpgrade idm-pki-symkey-debuginfoUpgrade xml-commons-apisUpgrade idm-pki-baseUpgrade jss-debugsourceUpgrade pki-servlet-engineUpgrade pki-jackson-annotationsUpgrade xsomUpgrade idm-pki-tools-debuginfoUpgrade xmlstreambufferUpgrade idm-tomcatjssUpgrade jackson-jaxrs-json-providerUpgrade idm-jss-debuginfoUpgrade jackson-module-jaxb-annotationsUpgrade idm-ldapjdk-javadocUpgrade idm-pki-acmeUpgrade glassfish-fastinfosetUpgrade relaxngDatatypeUpgrade jackson-jaxrs-providersUpgrade idm-pki-kraUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade fasterxml-oss-parentUpgrade idm-jssUpgrade javassist-javadocUpgrade idm-ldapjdkUpgrade stax-exUpgrade jakarta-commons-httpclientUpgrade jackson-parentUpgrade pki-jackson-jaxrs-providersUpgrade velocity | May 15, 2023 | Mar 11, 2022 |
| Rocky_linux | — | Upgrade jss-debugsourceUpgrade pki-core-debugsourceUpgrade idm-pki-tools-debuginfoUpgrade idm-jss-debuginfoUpgrade pki-core-debuginfoUpgrade idm-pki-symkey-debuginfoUpgrade idm-pki-toolsUpgrade idm-pki-symkeyUpgrade idm-jssUpgrade idm-jss-javadoc | Jun 17, 2024 | Mar 11, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.12Upgrade Splunk Enterprise to version 8.2.9Upgrade Splunk Enterprise to version 9.0.2 | Sep 30, 2025 | Mar 11, 2022 |
| Suse | — | Upgrade jackson-dataformat-smileUpgrade jackson-dataformats-binary-javadocUpgrade jackson-annotations-javadocUpgrade jackson-databind-javadocUpgrade jackson-dataformat-cborUpgrade jackson-bomUpgrade jackson-coreUpgrade jackson-dataformats-binaryUpgrade jackson-core-javadocUpgrade jackson-annotationsUpgrade jackson-databind | Aug 9, 2024 | Mar 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub