jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade javassist-javadocUpgrade xml-commons-apisUpgrade stax-exUpgrade jackson-coreUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-runtimeUpgrade jackson-bomUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade xerces-j2Upgrade jackson-modules-baseUpgrade apache-commons-langUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade pki-jackson-annotationsUpgrade jackson-databindUpgrade bea-stax-apiUpgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade pki-jackson-coreUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-coreUpgrade pki-jackson-jaxrs-providersUpgrade relaxngDatatypeUpgrade fasterxml-oss-parentUpgrade jackson-annotationsUpgrade pki-jackson-module-jaxb-annotationsUpgrade apache-commons-netUpgrade xalan-j2Upgrade pki-jackson-databindUpgrade apache-commons-collectionsUpgrade javassistUpgrade jackson-parentUpgrade pki-jackson-jaxrs-json-providerUpgrade slf4jUpgrade jakarta-commons-httpclient | Aug 11, 2025 | Jul 30, 2025 |
| Amazon Linux Ami 2 | — | Upgrade jacksonUpgrade jackson-javadoc | May 20, 2026 | May 20, 2026 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Jan 21, 2026 | Jan 20, 2026 |
| Debian | — | No solution existsUpgrade jackson-core | Jun 27, 2025 | Jun 25, 2025 |
| Oracle_linux | — | Upgrade jackson-parentUpgrade velocityUpgrade pki-jackson-databindUpgrade pki-jackson-jaxrs-providersUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade slf4jUpgrade bea-stax-apiUpgrade stax-exUpgrade jackson-module-jaxb-annotationsUpgrade pki-servlet-engineUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade pki-jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade pki-jackson-coreUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade glassfish-jaxb-txw2Upgrade xml-commons-apisUpgrade jackson-databindUpgrade xsomUpgrade xalan-j2Upgrade jackson-modules-baseUpgrade pki-jackson-annotationsUpgrade jackson-annotationsUpgrade jackson-bomUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-netUpgrade xmlstreambufferUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade fasterxml-oss-parentUpgrade xerces-j2Upgrade xml-commons-resolverUpgrade jackson-coreUpgrade pki-jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-runtime | Aug 1, 2025 | Jun 25, 2025 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Jun 26, 2025 | Jun 25, 2025 |
| Redhat_linux | — | Upgrade xml-commons-resolverUpgrade pki-servlet-engineUpgrade slf4j-jdk14Upgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade xerces-j2Upgrade velocityNo solution existsUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade bea-stax-apiUpgrade stax-exUpgrade jackson-coreUpgrade jackson-modules-baseUpgrade pki-jackson-jaxrs-providersUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade jackson-bomUpgrade fasterxml-oss-parentUpgrade glassfish-jaxb-coreUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade jackson-parentUpgrade jackson-annotationsUpgrade relaxngDatatypeUpgrade apache-commons-langUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-jaxrs-json-providerUpgrade javassistUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade pki-jackson-coreUpgrade xalan-j2Upgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade pki-jackson-databindUpgrade pki-jackson-annotationsUpgrade apache-commons-netUpgrade xml-commons-apis | Jul 9, 2025 | Jun 25, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.9Upgrade Splunk Enterprise to version 9.3.7Upgrade Splunk Enterprise to version 9.4.5Upgrade Splunk Enterprise to version 10.0.1 | Nov 12, 2025 | Jun 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub