jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xmlstreambufferUpgrade xerces-j2Upgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade apache-commons-netUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade jackson-coreUpgrade pki-jackson-databindUpgrade relaxngDatatypeUpgrade xsomUpgrade slf4jUpgrade slf4j-jdk14Upgrade jackson-jaxrs-json-providerUpgrade jackson-jaxrs-providersUpgrade fasterxml-oss-parentUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade jackson-databindUpgrade jackson-bomUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade stax-exUpgrade jackson-parentUpgrade jackson-modules-baseUpgrade pki-servlet-engineUpgrade javassistUpgrade velocityUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-fastinfosetUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade apache-commons-lang | May 15, 2023 | Mar 11, 2022 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 14, 2024 | Oct 17, 2023 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Centos_linux | — | Upgrade pki-jackson-coreUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-databindUpgrade pki-jackson-annotationsUpgrade pki-jackson-jaxrs-json-providerUpgrade pki-jackson-jaxrs-providers | May 15, 2023 | Mar 11, 2022 |
| Debian | — | Upgrade jackson-databind | May 4, 2022 | Mar 11, 2022 |
| Freebsd | — | Upgrade kafka | Feb 6, 2023 | Feb 4, 2023 |
| Oracle Missing Cpu Oct 2022 | — | Apply the October 2022 Critical Patch Update (CPU) for Oracle Database | Oct 26, 2022 | Mar 11, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34429365 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0. | Jul 25, 2022 | Mar 11, 2022 |
| Oracle_linux | — | Upgrade idm-pki-kraUpgrade jackson-modules-baseUpgrade pki-jackson-coreUpgrade idm-jss-javadocUpgrade idm-pki-base-javaUpgrade glassfish-jaxb-coreUpgrade idm-pki-symkeyUpgrade apache-commons-collectionsUpgrade jackson-bomUpgrade pki-jackson-jaxrs-providersUpgrade javassistUpgrade idm-pki-acmeUpgrade pki-jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade python3-idm-pkiUpgrade glassfish-jaxb-runtimeUpgrade idm-ldapjdkUpgrade slf4j-jdk14Upgrade bea-stax-apiUpgrade idm-ldapjdk-javadocUpgrade idm-pki-baseUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-servlet-engineUpgrade jackson-jaxrs-providersUpgrade xerces-j2Upgrade xml-commons-resolverUpgrade fasterxml-oss-parentUpgrade stax-exUpgrade velocityUpgrade xmlstreambufferUpgrade idm-jssUpgrade idm-pki-caUpgrade idm-pki-serverUpgrade javassist-javadocUpgrade pki-jackson-jaxrs-json-providerUpgrade xalan-j2Upgrade jackson-coreUpgrade resteasyUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade idm-pki-toolsUpgrade glassfish-jaxb-txw2Upgrade jackson-annotationsUpgrade slf4jUpgrade jackson-parentUpgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade xml-commons-apisUpgrade apache-commons-netUpgrade apache-commons-langUpgrade pki-jackson-databindUpgrade resteasy-javadocUpgrade relaxngDatatypeUpgrade idm-tomcatjssUpgrade glassfish-fastinfoset | May 17, 2023 | Aug 13, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 11, 2022 |
| Redhat_linux | — | Upgrade jackson-modules-baseUpgrade idm-pki-symkeyUpgrade python3-idm-pkiUpgrade idm-pki-caUpgrade xml-commons-resolverUpgrade slf4j-jdk14Upgrade idm-jss-javadocUpgrade jackson-parentUpgrade javassist-javadocUpgrade velocityUpgrade javassistUpgrade pki-jackson-coreUpgrade jackson-bomUpgrade idm-pki-serverUpgrade pki-core-debugsourceUpgrade bea-stax-apiUpgrade pki-jackson-databindUpgrade jakarta-commons-httpclientUpgrade apache-commons-collectionsUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade pki-jackson-jaxrs-providersUpgrade stax-exUpgrade idm-ldapjdkUpgrade pki-jackson-module-jaxb-annotationsUpgrade fasterxml-oss-parentUpgrade idm-jssUpgrade idm-pki-symkey-debuginfoUpgrade xalan-j2Upgrade glassfish-jaxb-apiUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade apache-commons-netUpgrade jackson-jaxrs-json-providerUpgrade resteasyUpgrade idm-pki-toolsUpgrade pki-servlet-engineUpgrade jackson-module-jaxb-annotationsUpgrade idm-pki-baseUpgrade pki-jackson-jaxrs-json-providerUpgrade idm-pki-acmeUpgrade jackson-coreUpgrade idm-pki-kraUpgrade xml-commons-apisUpgrade pki-jackson-annotationsUpgrade apache-commons-langUpgrade glassfish-jaxb-runtimeUpgrade xsomUpgrade idm-pki-base-javaUpgrade resteasy-javadocUpgrade idm-ldapjdk-javadocUpgrade idm-jss-debuginfoUpgrade jss-debugsourceUpgrade xmlstreambufferUpgrade jackson-databindUpgrade idm-pki-tools-debuginfoUpgrade slf4jUpgrade idm-tomcatjssUpgrade jackson-annotations | May 15, 2023 | Mar 11, 2022 |
| Rocky_linux | — | Upgrade idm-jss-javadocUpgrade idm-pki-toolsUpgrade idm-jssUpgrade idm-pki-symkeyUpgrade jss-debugsourceUpgrade idm-jss-debuginfoUpgrade pki-core-debuginfoUpgrade pki-core-debugsourceUpgrade idm-pki-symkey-debuginfoUpgrade idm-pki-tools-debuginfo | Jun 17, 2024 | Mar 11, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.9Upgrade Splunk Enterprise to version 9.0.2Upgrade Splunk Enterprise to version 8.1.12 | Sep 30, 2025 | Mar 11, 2022 |
| Suse | — | Upgrade jackson-coreUpgrade jackson-databindUpgrade jackson-dataformats-binaryUpgrade jackson-bomUpgrade jackson-core-javadocUpgrade jackson-annotationsUpgrade jackson-dataformat-cborUpgrade jackson-dataformat-smileUpgrade jackson-annotations-javadocUpgrade jackson-databind-javadocUpgrade jackson-dataformats-binary-javadoc | Aug 9, 2024 | Mar 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub