FasterXML jackson-databind up to 2.13.x Deserialize primitive resource consumption

Summaryinfo

A vulnerability identified as problematic has been detected in FasterXML jackson-databind up to 2.13.x. Affected by this issue is some unknown functionality of the component Deserialize Handler. This manipulation of the argument primitive causes resource consumption. The identification of this vulnerability is CVE-2022-42003. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in FasterXML jackson-databind up to 2.13.x (Programming Language Software). Affected by this vulnerability is some unknown functionality of the component Deserialize Handler. The manipulation of the argument primitive with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

The weakness was shared 10/02/2022 as 3590. It is possible to read the advisory at bugs.chromium.org. This vulnerability is known as CVE-2022-42003 since 10/02/2022. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 216682 (RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 (RHSA-2025:1746)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.14.0-rc1 eliminates this vulnerability. Applying the patch d78d00ee7b5245b93103fef3187f70543d67ca33 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (216682). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• FasterXML

Name

• jackson-databind

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13

License

• open-source

Website

• Product: https://github.com/FasterXML/jackson-databind/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion