jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade apache-commons-langUpgrade jackson-databindUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-txw2Upgrade stax-exUpgrade velocityUpgrade pki-jackson-annotationsUpgrade jackson-bomUpgrade bea-stax-apiUpgrade javassist-javadocUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-engineUpgrade jackson-module-jaxb-annotationsUpgrade xerces-j2Upgrade xml-commons-apisUpgrade jackson-coreUpgrade xml-commons-resolverUpgrade jackson-modules-baseUpgrade jackson-annotationsUpgrade pki-jackson-jaxrs-json-providerUpgrade glassfish-jaxb-coreUpgrade fasterxml-oss-parentUpgrade relaxngDatatypeUpgrade slf4jUpgrade javassistUpgrade pki-jackson-jaxrs-providersUpgrade xalan-j2Upgrade pki-jackson-coreUpgrade xsomUpgrade apache-commons-netUpgrade jackson-parentUpgrade apache-commons-collectionsUpgrade pki-jackson-databindUpgrade pki-jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade jakarta-commons-httpclient | Aug 11, 2025 | Jul 30, 2025 |
| Amazon Linux Ami 2 | — | Upgrade jacksonUpgrade jackson-javadoc | May 20, 2026 | May 20, 2026 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Jan 21, 2026 | Jan 20, 2026 |
| Debian | — | Upgrade jackson-coreNo solution exists | Jun 27, 2025 | Jun 25, 2025 |
| Oracle_linux | — | Upgrade bea-stax-apiUpgrade pki-jackson-coreUpgrade pki-servlet-engineUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-collectionsUpgrade stax-exUpgrade slf4jUpgrade pki-jackson-jaxrs-json-providerUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade pki-jackson-jaxrs-providersUpgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade pki-jackson-databindUpgrade velocityUpgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade jackson-jaxrs-providersUpgrade jackson-parentUpgrade jackson-annotationsUpgrade glassfish-jaxb-txw2Upgrade pki-jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade xsomUpgrade xerces-j2Upgrade relaxngDatatypeUpgrade javassist-javadocUpgrade fasterxml-oss-parentUpgrade xml-commons-resolverUpgrade jackson-coreUpgrade apache-commons-netUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade xmlstreambufferUpgrade jackson-modules-baseUpgrade jackson-bomUpgrade pki-jackson-annotationsUpgrade glassfish-jaxb-runtimeUpgrade jackson-databind | Aug 1, 2025 | Jun 25, 2025 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Jun 26, 2025 | Jun 25, 2025 |
| Redhat_linux | — | Upgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade jackson-bomUpgrade pki-servlet-engineUpgrade jackson-modules-baseUpgrade jackson-jaxrs-json-providerUpgrade pki-jackson-jaxrs-providersUpgrade glassfish-jaxb-txw2Upgrade fasterxml-oss-parentUpgrade glassfish-jaxb-coreUpgrade jackson-databindUpgrade velocityUpgrade stax-exUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade jackson-coreUpgrade bea-stax-apiUpgrade jackson-jaxrs-providersNo solution existsUpgrade glassfish-jaxb-apiUpgrade xml-commons-resolverUpgrade jackson-module-jaxb-annotationsUpgrade pki-jackson-coreUpgrade xsomUpgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade xml-commons-apisUpgrade pki-jackson-databindUpgrade pki-jackson-annotationsUpgrade xalan-j2Upgrade pki-jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclientUpgrade pki-jackson-jaxrs-json-providerUpgrade slf4jUpgrade javassistUpgrade apache-commons-netUpgrade jackson-parent | Jul 9, 2025 | Jun 25, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.0.1Upgrade Splunk Enterprise to version 9.4.5Upgrade Splunk Enterprise to version 9.3.7Upgrade Splunk Enterprise to version 9.2.9 | Nov 12, 2025 | Jun 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub