In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade aws-kinesis-agent | Mar 10, 2025 | Oct 2, 2022 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 14, 2024 | Oct 17, 2023 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Centos_linux | — | Upgrade rubygem-unf_ext-debuginfoUpgrade satellite-cliUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-http-acceptUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-ffi-debugsourceUpgrade rubygem-ffiUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-maintainUpgrade rubygem-unicode-display_widthUpgrade rubygem-apipie-bindingsUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unfUpgrade python39-pulp_manifestUpgrade rubygem-amazing_printUpgrade rubygem-ffi-debuginfoUpgrade rubygem-oauthUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_extUpgrade rubygem-snaky_hashUpgrade rubygem-http-cookieUpgrade rubygem-clampUpgrade rubygem-highlineUpgrade foreman-cliUpgrade rubygem-jwtUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade satellite-cloneUpgrade rubygem-version_gemUpgrade rubygem-unicode-debuginfoUpgrade rubygem-localeUpgrade rubygem-hammer_cliUpgrade rubygem-foreman_maintainUpgrade rubygem-hashieUpgrade rubygem-gssapiUpgrade rubygem-mime-types-dataUpgrade rubygem-rest-client | May 4, 2023 | Oct 2, 2022 |
| Debian | — | Upgrade jackson-databind | Nov 18, 2022 | Oct 2, 2022 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 22, 2023 |
| Freebsd | — | Upgrade cassandra3 | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade dev-java/jackson-databind. | Oct 31, 2022 | Oct 2, 2022 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 2, 2022 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 2, 2022 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-mime-types-dataUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-gssapiUpgrade rubygem-mime-typesUpgrade rubygem-unfUpgrade rubygem-unicode-debugsourceUpgrade rubygem-amazing_printUpgrade rubygem-loggingUpgrade rubygem-ffiUpgrade rubygem-unicode-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-unicodeUpgrade satellite-cloneUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-domain_nameUpgrade rubygem-little-pluggerUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-jwtUpgrade rubygem-multi_jsonNo solution existsUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-http-acceptUpgrade rubygem-apipie-bindingsUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-version_gemUpgrade satellite-maintainUpgrade rubygem-unicode-display_widthUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade python39-pulp_manifestUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-highlineUpgrade rubygem-oauthUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cliUpgrade rubygem-hashieUpgrade rubygem-ffi-debuginfoUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-powerbarUpgrade foreman-cli | May 4, 2023 | Oct 2, 2022 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfo | Mar 12, 2024 | Oct 2, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.0.5 | Sep 30, 2025 | Oct 2, 2022 |
| Suse | — | Upgrade jackson-databindUpgrade jackson-databind-javadoc | Nov 16, 2022 | Oct 2, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Oct 2, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub