jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.

An issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

Hitachi Ops Center Viewpoint contain the following vulnerabilities: CVE-2014-3643, CVE-2023-3635, CVE-2023-6378, CVE-2023-6481, CVE-2023-35116, CVE-2024-12798, CVE-2024-12801, CVE-2024-47554

mina-sshd: Java unsafe deserialization vulnerability infispan: REST bulk ops don't check permissions infinispan: Non-admins should not be able to get cache config via REST API infinispan: circular reference on marshalling leads to DoS netty: SniHandler 16MB allocation leads to OOM jackson-databind: denial of service via cylic dependencies apache-mina-sshd: information exposure in SFTP server implementations

Ein Angreifer kann eine Schwachstelle in FasterXML Jackson ausnutzen, um einen Denial of Service Angriff durchzuführen.