jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xerces-j2Upgrade apache-commons-langUpgrade stax-exUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade jackson-coreUpgrade pki-jackson-annotationsUpgrade jackson-databindUpgrade glassfish-fastinfosetUpgrade jackson-modules-baseUpgrade jackson-module-jaxb-annotationsUpgrade javassist-javadocUpgrade pki-servlet-engineUpgrade glassfish-jaxb-runtimeUpgrade bea-stax-apiUpgrade xml-commons-apisUpgrade jackson-bomUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade xalan-j2Upgrade pki-jackson-jaxrs-json-providerUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-databindUpgrade fasterxml-oss-parentUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-coreUpgrade jackson-annotationsUpgrade jackson-jaxrs-providersUpgrade pki-jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade relaxngDatatypeUpgrade apache-commons-collectionsUpgrade apache-commons-netUpgrade pki-jackson-coreUpgrade xsomUpgrade javassistUpgrade jackson-parentUpgrade slf4j | Aug 11, 2025 | Jul 30, 2025 |
| Amazon Linux Ami 2 | — | Upgrade jacksonUpgrade jackson-javadoc | May 20, 2026 | May 20, 2026 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Jan 21, 2026 | Jan 20, 2026 |
| Debian | — | Upgrade jackson-coreNo solution exists | Jun 27, 2025 | Jun 25, 2025 |
| Oracle_linux | — | Upgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade pki-jackson-jaxrs-json-providerUpgrade pki-jackson-coreUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade pki-jackson-jaxrs-providersUpgrade jackson-parentUpgrade slf4jUpgrade velocityUpgrade pki-jackson-databindUpgrade stax-exUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade pki-servlet-engineUpgrade jackson-module-jaxb-annotationsUpgrade javassist-javadocUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade fasterxml-oss-parentUpgrade xml-commons-resolverUpgrade xerces-j2Upgrade jackson-bomUpgrade jackson-modules-baseUpgrade pki-jackson-annotationsUpgrade xml-commons-apisUpgrade xsomUpgrade jackson-annotationsUpgrade jackson-coreUpgrade apache-commons-netUpgrade xalan-j2Upgrade xmlstreambufferUpgrade pki-jackson-module-jaxb-annotationsUpgrade jackson-databindUpgrade glassfish-jaxb-txw2 | Aug 1, 2025 | Jun 25, 2025 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Jun 26, 2025 | Jun 25, 2025 |
| Redhat_linux | — | Upgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade velocityUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferNo solution existsUpgrade jackson-bomUpgrade fasterxml-oss-parentUpgrade jackson-coreUpgrade jackson-modules-baseUpgrade xml-commons-resolverUpgrade pki-jackson-jaxrs-providersUpgrade jackson-jaxrs-providersUpgrade apache-commons-collectionsUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade pki-servlet-engineUpgrade stax-exUpgrade bea-stax-apiUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade javassistUpgrade pki-jackson-module-jaxb-annotationsUpgrade pki-jackson-coreUpgrade xml-commons-apisUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-fastinfosetUpgrade xsomUpgrade xalan-j2Upgrade apache-commons-langUpgrade pki-jackson-annotationsUpgrade pki-jackson-databindUpgrade jackson-parentUpgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade pki-jackson-jaxrs-json-providerUpgrade apache-commons-netUpgrade slf4jUpgrade jakarta-commons-httpclient | Jul 9, 2025 | Jun 25, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.5Upgrade Splunk Enterprise to version 9.3.7Upgrade Splunk Enterprise to version 10.0.1Upgrade Splunk Enterprise to version 9.2.9 | Nov 12, 2025 | Jun 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub