jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade apache-commons-langUpgrade glassfish-jaxb-txw2Upgrade glassfish-fastinfosetUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade jackson-module-jaxb-annotationsUpgrade pki-servlet-engineUpgrade xml-commons-apisUpgrade stax-exUpgrade javassist-javadocUpgrade jackson-databindUpgrade pki-jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade xerces-j2Upgrade velocityUpgrade jackson-modules-baseUpgrade jackson-bomUpgrade jackson-coreUpgrade xsomUpgrade relaxngDatatypeUpgrade pki-jackson-databindUpgrade javassistUpgrade glassfish-jaxb-coreUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade pki-jackson-jaxrs-providersUpgrade apache-commons-netUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-jaxrs-json-providerUpgrade jackson-parentUpgrade pki-jackson-coreUpgrade apache-commons-collectionsUpgrade jackson-annotationsUpgrade slf4jUpgrade fasterxml-oss-parentUpgrade jakarta-commons-httpclientUpgrade xalan-j2 | Aug 11, 2025 | Jul 30, 2025 |
| Amazon Linux Ami 2 | — | Upgrade jackson-javadocUpgrade jackson | May 20, 2026 | May 20, 2026 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Jan 21, 2026 | Jan 20, 2026 |
| Debian | — | Upgrade jackson-core | Jun 27, 2025 | Jun 25, 2025 |
| Oracle_linux | — | Upgrade javassistUpgrade pki-servlet-engineUpgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade stax-exUpgrade jackson-parentUpgrade velocityUpgrade pki-jackson-databindUpgrade slf4jUpgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade pki-jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade pki-jackson-jaxrs-json-providerUpgrade pki-jackson-coreUpgrade slf4j-jdk14Upgrade jackson-module-jaxb-annotationsUpgrade apache-commons-collectionsUpgrade jackson-jaxrs-providersUpgrade apache-commons-netUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade pki-jackson-module-jaxb-annotationsUpgrade jackson-modules-baseUpgrade jackson-bomUpgrade jackson-annotationsUpgrade pki-jackson-annotationsUpgrade xmlstreambufferUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade xsomUpgrade xalan-j2Upgrade jackson-coreUpgrade relaxngDatatypeUpgrade xerces-j2Upgrade fasterxml-oss-parent | Aug 1, 2025 | Jun 25, 2025 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Jun 26, 2025 | Jun 25, 2025 |
| Redhat_linux | — | Upgrade xml-commons-apisUpgrade pki-jackson-annotationsUpgrade jackson-annotationsUpgrade javassistUpgrade relaxngDatatypeUpgrade pki-jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade pki-jackson-coreUpgrade pki-jackson-databindUpgrade javassist-javadocUpgrade xalan-j2Upgrade jackson-parentUpgrade apache-commons-netUpgrade xsomUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade pki-jackson-jaxrs-json-providerUpgrade jakarta-commons-httpclientUpgrade velocityUpgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverNo solution existsUpgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade glassfish-jaxb-coreUpgrade jackson-databindUpgrade fasterxml-oss-parentUpgrade pki-servlet-engineUpgrade jackson-coreUpgrade jackson-jaxrs-providersUpgrade jackson-bomUpgrade stax-exUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade xerces-j2Upgrade pki-jackson-jaxrs-providersUpgrade jackson-modules-base | Jul 9, 2025 | Jun 25, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.5Upgrade Splunk Enterprise to version 10.0.1Upgrade Splunk Enterprise to version 9.3.7Upgrade Splunk Enterprise to version 9.2.9 | Nov 12, 2025 | Jun 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub