Uncontrolled Resource Consumption in FasterXML jackson-databind
High severity
GitHub Reviewed
Published
Oct 3, 2022
to the GitHub Advisory Database
•
Updated Mar 24, 2024
Package
Affected versions
< 2.12.7.1
>= 2.13.0, < 2.13.4
Patched versions
2.12.7.1
2.13.4
Description
Published by the National Vulnerability Database
Oct 2, 2022
Published to the GitHub Advisory Database
Oct 3, 2022
Reviewed
Oct 4, 2022
Last updated
Mar 24, 2024
In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
References