jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade jackson-coreUpgrade jackson-annotationsUpgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade xmlstreambufferUpgrade jackson-jaxrs-providersUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade fasterxml-oss-parentUpgrade apache-commons-netUpgrade relaxngDatatypeUpgrade slf4jUpgrade xml-commons-resolverUpgrade slf4j-jdk14Upgrade pki-jackson-databindUpgrade xsomUpgrade jackson-bomUpgrade jackson-databindUpgrade jackson-modules-baseUpgrade stax-exUpgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade pki-servlet-engineUpgrade javassistUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade jackson-parentUpgrade velocityUpgrade jackson-module-jaxb-annotations | May 15, 2023 | Mar 11, 2022 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 14, 2024 | Oct 17, 2023 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Centos_linux | — | Upgrade pki-jackson-jaxrs-json-providerUpgrade pki-jackson-jaxrs-providersUpgrade pki-jackson-annotationsUpgrade pki-jackson-coreUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-databind | May 15, 2023 | Mar 11, 2022 |
| Debian | — | Upgrade jackson-databind | May 4, 2022 | Mar 11, 2022 |
| Freebsd | — | Upgrade kafka | Feb 6, 2023 | Feb 4, 2023 |
| Oracle Missing Cpu Oct 2022 | — | Apply the October 2022 Critical Patch Update (CPU) for Oracle Database | Oct 26, 2022 | Mar 11, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 34429365 for version 14.1.1.0.0. | Jul 25, 2022 | Mar 11, 2022 |
| Oracle_linux | — | Upgrade velocityUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade python3-idm-pkiUpgrade xerces-j2Upgrade idm-pki-caUpgrade pki-servlet-engineUpgrade jackson-modules-baseUpgrade bea-stax-apiUpgrade idm-pki-kraUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade pki-jackson-coreUpgrade glassfish-jaxb-coreUpgrade idm-pki-acmeUpgrade idm-jssUpgrade fasterxml-oss-parentUpgrade pki-jackson-jaxrs-providersUpgrade idm-jss-javadocUpgrade jackson-bomUpgrade xml-commons-resolverUpgrade idm-ldapjdk-javadocUpgrade idm-pki-baseUpgrade pki-jackson-module-jaxb-annotationsUpgrade idm-pki-symkeyUpgrade javassistUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade idm-ldapjdkUpgrade idm-pki-base-javaUpgrade xmlstreambufferUpgrade pki-jackson-annotationsUpgrade jakarta-commons-httpclientUpgrade jackson-databindUpgrade idm-pki-serverUpgrade javassist-javadocUpgrade slf4jUpgrade jackson-coreUpgrade xsomUpgrade resteasyUpgrade xalan-j2Upgrade idm-pki-toolsUpgrade glassfish-jaxb-txw2Upgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade resteasy-javadocUpgrade pki-jackson-jaxrs-json-providerUpgrade idm-tomcatjssUpgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade pki-jackson-databindUpgrade apache-commons-netUpgrade relaxngDatatypeUpgrade xml-commons-apisUpgrade jackson-parentUpgrade jackson-jaxrs-json-provider | May 17, 2023 | Aug 13, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 11, 2022 |
| Redhat_linux | — | Upgrade jackson-bomUpgrade idm-pki-symkeyUpgrade velocityUpgrade pki-jackson-module-jaxb-annotationsUpgrade apache-commons-collectionsUpgrade idm-jss-javadocUpgrade slf4j-jdk14Upgrade idm-pki-caUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade pki-core-debuginfoUpgrade pki-jackson-databindUpgrade javassistUpgrade fasterxml-oss-parentUpgrade stax-exUpgrade idm-jssUpgrade python3-idm-pkiUpgrade xml-commons-resolverUpgrade pki-core-debugsourceUpgrade jackson-modules-baseUpgrade jakarta-commons-httpclientUpgrade pki-jackson-coreUpgrade bea-stax-apiUpgrade pki-jackson-jaxrs-providersUpgrade jackson-parentUpgrade idm-pki-serverUpgrade javassist-javadocUpgrade idm-ldapjdkUpgrade jackson-coreUpgrade idm-pki-tools-debuginfoUpgrade apache-commons-langUpgrade xalan-j2Upgrade idm-tomcatjssUpgrade idm-pki-kraUpgrade glassfish-jaxb-apiUpgrade pki-jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade slf4jUpgrade apache-commons-netUpgrade idm-pki-toolsUpgrade jackson-jaxrs-json-providerUpgrade idm-pki-symkey-debuginfoUpgrade glassfish-fastinfosetUpgrade idm-ldapjdk-javadocUpgrade idm-jss-debuginfoUpgrade jss-debugsourceUpgrade jackson-databindUpgrade jackson-annotationsUpgrade idm-pki-base-javaUpgrade jackson-jaxrs-providersUpgrade resteasyUpgrade relaxngDatatypeUpgrade pki-jackson-annotationsUpgrade xml-commons-apisUpgrade xsomUpgrade xmlstreambufferUpgrade resteasy-javadocUpgrade idm-pki-baseUpgrade jackson-module-jaxb-annotationsUpgrade pki-servlet-engineUpgrade xerces-j2Upgrade idm-pki-acme | May 15, 2023 | Mar 11, 2022 |
| Rocky_linux | — | Upgrade idm-pki-toolsUpgrade idm-pki-symkeyUpgrade idm-jss-javadocUpgrade idm-jssUpgrade idm-pki-tools-debuginfoUpgrade idm-jss-debuginfoUpgrade pki-core-debugsourceUpgrade jss-debugsourceUpgrade idm-pki-symkey-debuginfoUpgrade pki-core-debuginfo | Jun 17, 2024 | Mar 11, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.2Upgrade Splunk Enterprise to version 8.2.9Upgrade Splunk Enterprise to version 8.1.12 | Sep 30, 2025 | Mar 11, 2022 |
| Suse | — | Upgrade jackson-dataformat-cborUpgrade jackson-databind-javadocUpgrade jackson-annotations-javadocUpgrade jackson-dataformat-smileUpgrade jackson-dataformats-binary-javadocUpgrade jackson-bomUpgrade jackson-coreUpgrade jackson-databindUpgrade jackson-annotationsUpgrade jackson-core-javadocUpgrade jackson-dataformats-binary | Aug 9, 2024 | Mar 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub