Most recent entries from all

ALSA-2023:2312 — Moderate: jackson security update

Affected: AlmaLinux:9: pki-jackson-databind

Jackson is a suite of data-processing tools for Java, including the flagship streaming JSON parser / generator library, matching data-binding library, and additional modules to process data encoded in various other data formats.

Security Fix(es):

* jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2024-00114

certfr-2022-avi-626 — De multiples vulnérabilités ont été découvertes dans IBM i Modernization. Certaines d'entre elles permettent à un attaq…

certfr-2022-avi-626

EUVD-2026-251098

fkie_cve-2020-36518

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

GHSA-57j2-w4cx-62h2 — Deeply nested json in jackson-databind

Affected: Maven: com.fasterxml.jackson.core:jackson-databind

jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack overflow exception and denial of service via a large depth of nested objects.

gsd-2020-36518

OESA-2023-1921 — jackson-databind security update

Affected: openEuler:20.03-LTS-SP1: jackson-databind, openEuler:20.03-LTS-SP3: jackson-databind, openEuler:22.03-LTS: jackson-databind, openEuler:22.03-LTS-SP1: jackson-databind, openEuler:22.03-LTS-SP2: jackson-databind

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fix(es): jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.(CVE-2020-36518) In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1(CVE-2022-42003) In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.(CVE-2022-42004)

openSUSE-SU-2024:12096-1 — jackson-databind-2.13.0-2.1 on GA media

jackson-databind-2.13.0-2.1 on GA media

RHSA-2022:2232 — Red Hat Security Advisory: Red Hat Data Grid 8.3.1 security update

jackson-databind: denial of service via a large depth of nested objects Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr

UBUNTU-CVE-2020-36518

Affected: Ubuntu:Pro:14.04:LTS: jackson-databind, Ubuntu:Pro:16.04:LTS: jackson-databind, Ubuntu:18.04:LTS: jackson-databind, Ubuntu:20.04:LTS: jackson-databind, Ubuntu:22.04:LTS: jackson-databind, Ubuntu:24.04:LTS: jackson-databind, Ubuntu:25.10: jackson-databind, Ubuntu:26.04:LTS: jackson-databind

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

WID-SEC-W-2022-0360 — FasterXML Jackson: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in FasterXML Jackson ausnutzen, um einen Denial of Service Angriff durchzuführen.