In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 14, 2024 | Oct 17, 2023 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Centos_linux | — | Upgrade satellite-cloneUpgrade rubygem-foreman_maintainUpgrade satellite-cliUpgrade foreman-cli | May 4, 2023 | Oct 2, 2022 |
| Debian | — | Upgrade jackson-databind | Nov 18, 2022 | Oct 2, 2022 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| Freebsd | — | Upgrade cassandra3 | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade dev-java/jackson-databind. | Oct 31, 2022 | Oct 2, 2022 |
| Oracle Missing Cpu Jan 2023 | — | Apply the January 2023 Critical Patch Update (CPU) for Oracle Database | Jan 17, 2023 | Oct 2, 2022 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 2, 2022 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 2, 2022 |
| Redhat_linux | — | Upgrade rubygem-highlineUpgrade rubygem-ffiUpgrade satellite-maintainUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-clampUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_adminUpgrade foreman-cliUpgrade rubygem-unicode-display_widthUpgrade satellite-cloneUpgrade rubygem-hammer_cliUpgrade rubygem-multi_jsonUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-fast_gettextUpgrade rubygem-apipie-bindingsNo solution existsUpgrade rubygem-ffi-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-oauthUpgrade rubygem-domain_nameUpgrade rubygem-http-cookieUpgrade rubygem-unfUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-version_gemUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_extUpgrade rubygem-rest-clientUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-debugsourceUpgrade rubygem-amazing_printUpgrade rubygem-little-pluggerUpgrade satellite-cliUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_openscapUpgrade python39-pulp_manifestUpgrade rubygem-localeUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-jwtUpgrade rubygem-http-accept | May 4, 2023 | Oct 2, 2022 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfo | Mar 12, 2024 | Oct 2, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Oct 2, 2022 |
| Suse | — | Upgrade jackson-databind-javadocUpgrade jackson-databind | Nov 16, 2022 | Oct 2, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Oct 2, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub