jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-runtimeUpgrade slf4jUpgrade glassfish-jaxb-txw2Upgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade xml-commons-resolverUpgrade jackson-databindUpgrade jackson-bomUpgrade xsomUpgrade relaxngDatatypeUpgrade xmlstreambufferUpgrade pki-jackson-databindUpgrade xml-commons-apisUpgrade xalan-j2Upgrade slf4j-jdk14Upgrade jackson-jaxrs-json-providerUpgrade apache-commons-netUpgrade fasterxml-oss-parentUpgrade jackson-coreUpgrade jackson-annotationsUpgrade javassist-javadocUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade glassfish-jaxb-coreUpgrade velocityUpgrade jackson-modules-baseUpgrade glassfish-fastinfosetUpgrade apache-commons-collectionsUpgrade jakarta-commons-httpclientUpgrade pki-servlet-engineUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade stax-exUpgrade jackson-parent | May 15, 2023 | Mar 11, 2022 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 14, 2024 | Oct 17, 2023 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Centos_linux | — | Upgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-databindUpgrade pki-jackson-coreUpgrade pki-jackson-jaxrs-providersUpgrade pki-jackson-jaxrs-json-providerUpgrade pki-jackson-annotations | May 15, 2023 | Mar 11, 2022 |
| Debian | — | Upgrade jackson-databind | May 4, 2022 | Mar 11, 2022 |
| Freebsd | — | Upgrade kafka | Feb 6, 2023 | Feb 4, 2023 |
| Oracle Missing Cpu Oct 2022 | — | Apply the October 2022 Critical Patch Update (CPU) for Oracle Database | Oct 26, 2022 | Mar 11, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34429365 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0. | Jul 25, 2022 | Mar 11, 2022 |
| Oracle_linux | — | Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade pki-jackson-jaxrs-providersUpgrade idm-jss-javadocUpgrade idm-pki-acmeUpgrade xml-commons-resolverUpgrade glassfish-jaxb-coreUpgrade velocityUpgrade jackson-bomUpgrade pki-jackson-annotationsUpgrade idm-pki-base-javaUpgrade idm-pki-kraUpgrade stax-exUpgrade pki-servlet-engineUpgrade jackson-modules-baseUpgrade jakarta-commons-httpclientUpgrade fasterxml-oss-parentUpgrade xerces-j2Upgrade xmlstreambufferUpgrade javassistUpgrade bea-stax-apiUpgrade python3-idm-pkiUpgrade pki-jackson-coreUpgrade idm-pki-symkeyUpgrade jackson-jaxrs-providersUpgrade idm-jssUpgrade idm-pki-caUpgrade idm-ldapjdkUpgrade pki-jackson-module-jaxb-annotationsUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade idm-ldapjdk-javadocUpgrade idm-pki-baseUpgrade glassfish-jaxb-txw2Upgrade idm-pki-toolsUpgrade jackson-annotationsUpgrade relaxngDatatypeUpgrade idm-tomcatjssUpgrade resteasy-javadocUpgrade pki-jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade idm-pki-serverUpgrade xml-commons-apisUpgrade pki-jackson-databindUpgrade apache-commons-netUpgrade apache-commons-langUpgrade jackson-coreUpgrade xsomUpgrade xalan-j2Upgrade resteasyUpgrade jackson-parentUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade slf4j | May 17, 2023 | Aug 13, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 11, 2022 |
| Redhat_linux | — | Upgrade xml-commons-resolverUpgrade idm-pki-symkeyUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-jaxrs-providersUpgrade jackson-parentUpgrade slf4j-jdk14Upgrade jakarta-commons-httpclientUpgrade pki-core-debuginfoUpgrade pki-core-debugsourceUpgrade idm-pki-caUpgrade jackson-bomUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade idm-jss-javadocUpgrade jackson-modules-baseUpgrade fasterxml-oss-parentUpgrade javassist-javadocUpgrade velocityUpgrade idm-ldapjdkUpgrade bea-stax-apiUpgrade pki-jackson-coreUpgrade idm-jssUpgrade stax-exUpgrade python3-idm-pkiUpgrade idm-pki-serverUpgrade pki-jackson-databindUpgrade apache-commons-collectionsUpgrade javassistUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-netUpgrade idm-pki-base-javaUpgrade apache-commons-langUpgrade resteasy-javadocUpgrade glassfish-fastinfosetUpgrade jackson-jaxrs-providersUpgrade resteasyUpgrade pki-servlet-engineUpgrade idm-pki-acmeUpgrade idm-pki-baseUpgrade jackson-module-jaxb-annotationsUpgrade idm-pki-tools-debuginfoUpgrade xmlstreambufferUpgrade xml-commons-apisUpgrade glassfish-jaxb-apiUpgrade jackson-coreUpgrade idm-pki-kraUpgrade pki-jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade slf4jUpgrade xalan-j2Upgrade idm-tomcatjssUpgrade idm-ldapjdk-javadocUpgrade idm-jss-debuginfoUpgrade relaxngDatatypeUpgrade xerces-j2Upgrade xsomUpgrade pki-jackson-annotationsUpgrade jss-debugsourceUpgrade jackson-databindUpgrade jackson-annotationsUpgrade idm-pki-symkey-debuginfoUpgrade idm-pki-tools | May 15, 2023 | Mar 11, 2022 |
| Rocky_linux | — | Upgrade idm-jssUpgrade idm-pki-toolsUpgrade idm-jss-javadocUpgrade idm-pki-symkeyUpgrade pki-core-debugsourceUpgrade idm-pki-symkey-debuginfoUpgrade idm-pki-tools-debuginfoUpgrade pki-core-debuginfoUpgrade jss-debugsourceUpgrade idm-jss-debuginfo | Jun 17, 2024 | Mar 11, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.9Upgrade Splunk Enterprise to version 9.0.2Upgrade Splunk Enterprise to version 8.1.12 | Sep 30, 2025 | Mar 11, 2022 |
| Suse | — | Upgrade jackson-core-javadocUpgrade jackson-annotationsUpgrade jackson-coreUpgrade jackson-databindUpgrade jackson-dataformats-binaryUpgrade jackson-bomUpgrade jackson-dataformats-binary-javadocUpgrade jackson-annotations-javadocUpgrade jackson-dataformat-smileUpgrade jackson-databind-javadocUpgrade jackson-dataformat-cbor | Aug 9, 2024 | Mar 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub