In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade aws-kinesis-agent | Mar 10, 2025 | Oct 2, 2022 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 14, 2024 | Oct 17, 2023 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Centos_linux | — | Upgrade satellite-cloneUpgrade rubygem-jwtUpgrade rubygem-http-cookieUpgrade foreman-cliUpgrade rubygem-amazing_printUpgrade python39-pulp_manifestUpgrade rubygem-version_gemUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-highlineUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_extUpgrade rubygem-oauthUpgrade rubygem-unfUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cliUpgrade rubygem-foreman_maintainUpgrade rubygem-localeUpgrade rubygem-rest-clientUpgrade rubygem-mime-types-dataUpgrade rubygem-gssapiUpgrade rubygem-snaky_hashUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debuginfoUpgrade rubygem-ffi-debugsourceUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-multi_jsonUpgrade rubygem-little-pluggerUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicodeUpgrade satellite-maintainUpgrade rubygem-netrcUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-loggingUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-ffi | May 4, 2023 | Oct 2, 2022 |
| Debian | — | Upgrade jackson-databind | Nov 18, 2022 | Oct 2, 2022 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 22, 2023 |
| Freebsd | — | Upgrade cassandra3 | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade dev-java/jackson-databind. | Oct 31, 2022 | Oct 2, 2022 |
| Oracle Missing Cpu Jan 2023 | — | Apply the January 2023 Critical Patch Update (CPU) for Oracle Database | Sep 1, 2026 | Oct 2, 2022 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 2, 2022 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 2, 2022 |
| Redhat_linux | — | Upgrade rubygem-unicodeUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debuginfoUpgrade rubygem-ffiUpgrade rubygem-mime-typesUpgrade rubygem-unfUpgrade rubygem-snaky_hashUpgrade rubygem-unicode-debugsourceUpgrade rubygem-mime-types-dataUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-jwtUpgrade rubygem-little-pluggerUpgrade rubygem-multi_jsonUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-http-acceptUpgrade rubygem-ffi-debugsourceUpgrade rubygem-amazing_printNo solution existsUpgrade rubygem-apipie-bindingsUpgrade rubygem-oauth-ttyUpgrade rubygem-loggingUpgrade satellite-cloneUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-gssapiUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-foreman_maintainUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade foreman-cliUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-version_gemUpgrade rubygem-http-cookieUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hashieUpgrade rubygem-unicode-display_widthUpgrade rubygem-powerbarUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade python39-pulp_manifestUpgrade rubygem-rest-clientUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-maintainUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_templates | May 4, 2023 | Oct 2, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debuginfo | Mar 12, 2024 | Oct 2, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11 | Sep 30, 2025 | Oct 2, 2022 |
| Suse | — | Upgrade jackson-databind-javadocUpgrade jackson-databind | Nov 16, 2022 | Oct 2, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Oct 2, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub