HIGH7.5
GHSA-3x8x-79m2-3w2w
jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode
Quick fix
GHSA-3x8x-79m2-3w2w — com.fasterxml.jackson.core:jackson-databind: upgrade to the fixed version with the command below.
# pom.xml: bump <version>2.12.6</version> for com.fasterxml.jackson.core:jackson-databindDetails
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/com.fasterxml.jackson.core:jackson-databind
Introduced in:
2.10.0Fixed in: 2.12.6Fix
# pom.xml: bump <version>2.12.6</version> for com.fasterxml.jackson.core:jackson-databindMaven/com.fasterxml.jackson.core:jackson-databind
Introduced in:
2.13.0Fixed in: 2.13.1Fix
# pom.xml: bump <version>2.13.1</version> for com.fasterxml.jackson.core:jackson-databindReferences
- https://nvd.nist.gov/vuln/detail/CVE-2021-46877[ADVISORY]
- https://github.com/FasterXML/jackson-databind/issues/3328[WEB]
- https://github.com/FasterXML/jackson-databind/commit/3ccde7d938fea547e598fdefe9a82cff37fed5cb[WEB]
- https://github.com/FasterXML/jackson-databind[PACKAGE]
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.12.6[WEB]
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13.1[WEB]
- https://groups.google.com/g/jackson-user/c/OsBsirPM_Vw[WEB]