jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-apache-commons-collectionsalma-upgrade-apache-commons-langalma-upgrade-apache-commons-netalma-upgrade-bea-stax-apialma-upgrade-fasterxml-oss-parentalma-upgrade-glassfish-fastinfosetalma-upgrade-glassfish-jaxb-apialma-upgrade-glassfish-jaxb-corealma-upgrade-glassfish-jaxb-runtimealma-upgrade-glassfish-jaxb-txw2alma-upgrade-jackson-annotationsalma-upgrade-jackson-bomalma-upgrade-jackson-corealma-upgrade-jackson-databindalma-upgrade-jackson-jaxrs-json-provideralma-upgrade-jackson-jaxrs-providersalma-upgrade-jackson-module-jaxb-annotationsalma-upgrade-jackson-modules-basealma-upgrade-jackson-parentalma-upgrade-jakarta-commons-httpclientalma-upgrade-javassistalma-upgrade-javassist-javadocalma-upgrade-pki-jackson-annotationsalma-upgrade-pki-jackson-corealma-upgrade-pki-jackson-databindalma-upgrade-pki-jackson-jaxrs-json-provideralma-upgrade-pki-jackson-jaxrs-providersalma-upgrade-pki-jackson-module-jaxb-annotationsalma-upgrade-pki-servlet-enginealma-upgrade-relaxngdatatypealma-upgrade-slf4jalma-upgrade-slf4j-jdk14alma-upgrade-stax-exalma-upgrade-velocityalma-upgrade-xalan-j2alma-upgrade-xerces-j2alma-upgrade-xml-commons-apisalma-upgrade-xml-commons-resolveralma-upgrade-xmlstreambufferalma-upgrade-xsom | Aug 11, 2025 | Jul 30, 2025 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-jacksonamazon-linux-ami-2-upgrade-jackson-javadoc | May 20, 2026 | May 20, 2026 | |
| Atlassian Bitbucket | atlassian-bitbucket-upgrade-latest | Jan 21, 2026 | Jan 20, 2026 | |
| Debian | debian-upgrade-jackson-coreno-fix-debian-deb-package | Jun 27, 2025 | Jun 25, 2025 | |
| Oracle_linux | — | oracle-linux-upgrade-apache-commons-collectionsoracle-linux-upgrade-apache-commons-langoracle-linux-upgrade-apache-commons-netoracle-linux-upgrade-bea-stax-apioracle-linux-upgrade-fasterxml-oss-parentoracle-linux-upgrade-glassfish-fastinfosetoracle-linux-upgrade-glassfish-jaxb-apioracle-linux-upgrade-glassfish-jaxb-coreoracle-linux-upgrade-glassfish-jaxb-runtimeoracle-linux-upgrade-glassfish-jaxb-txw2oracle-linux-upgrade-jackson-annotationsoracle-linux-upgrade-jackson-bomoracle-linux-upgrade-jackson-coreoracle-linux-upgrade-jackson-databindoracle-linux-upgrade-jackson-jaxrs-json-provideroracle-linux-upgrade-jackson-jaxrs-providersoracle-linux-upgrade-jackson-module-jaxb-annotationsoracle-linux-upgrade-jackson-modules-baseoracle-linux-upgrade-jackson-parentoracle-linux-upgrade-jakarta-commons-httpclientoracle-linux-upgrade-javassistoracle-linux-upgrade-javassist-javadocoracle-linux-upgrade-pki-jackson-annotationsoracle-linux-upgrade-pki-jackson-coreoracle-linux-upgrade-pki-jackson-databindoracle-linux-upgrade-pki-jackson-jaxrs-json-provideroracle-linux-upgrade-pki-jackson-jaxrs-providersoracle-linux-upgrade-pki-jackson-module-jaxb-annotationsoracle-linux-upgrade-pki-servlet-engineoracle-linux-upgrade-relaxngdatatypeoracle-linux-upgrade-slf4joracle-linux-upgrade-slf4j-jdk14oracle-linux-upgrade-stax-exoracle-linux-upgrade-velocityoracle-linux-upgrade-xalan-j2oracle-linux-upgrade-xerces-j2oracle-linux-upgrade-xml-commons-apisoracle-linux-upgrade-xml-commons-resolveroracle-linux-upgrade-xmlstreambufferoracle-linux-upgrade-xsom | Aug 1, 2025 | Jun 25, 2025 |
| Red Hat Jboss Eap | red-hat-jboss-eap-upgrade-latest | Jun 26, 2025 | Jun 25, 2025 | |
| Redhat_linux | redhat-upgrade-apache-commons-collectionsredhat-upgrade-apache-commons-langredhat-upgrade-apache-commons-netredhat-upgrade-bea-stax-apiredhat-upgrade-fasterxml-oss-parentredhat-upgrade-glassfish-fastinfosetredhat-upgrade-glassfish-jaxb-apiredhat-upgrade-glassfish-jaxb-coreredhat-upgrade-glassfish-jaxb-runtimeredhat-upgrade-glassfish-jaxb-txw2redhat-upgrade-jackson-annotationsredhat-upgrade-jackson-bomredhat-upgrade-jackson-coreredhat-upgrade-jackson-databindredhat-upgrade-jackson-jaxrs-json-providerredhat-upgrade-jackson-jaxrs-providersredhat-upgrade-jackson-module-jaxb-annotationsredhat-upgrade-jackson-modules-baseredhat-upgrade-jackson-parentredhat-upgrade-jakarta-commons-httpclientredhat-upgrade-javassistredhat-upgrade-javassist-javadocredhat-upgrade-pki-jackson-annotationsredhat-upgrade-pki-jackson-coreredhat-upgrade-pki-jackson-databindredhat-upgrade-pki-jackson-jaxrs-json-providerredhat-upgrade-pki-jackson-jaxrs-providersredhat-upgrade-pki-jackson-module-jaxb-annotationsredhat-upgrade-pki-servlet-engineredhat-upgrade-relaxngdatatyperedhat-upgrade-slf4jredhat-upgrade-slf4j-jdk14redhat-upgrade-stax-exredhat-upgrade-velocityredhat-upgrade-xalan-j2redhat-upgrade-xerces-j2redhat-upgrade-xml-commons-apisredhat-upgrade-xml-commons-resolverredhat-upgrade-xmlstreambufferredhat-upgrade-xsom | Jul 9, 2025 | Jun 25, 2025 | |
| Splunk | splunk-upgrade-latest | Nov 12, 2025 | Jun 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub