CVE-2025-59250 — JDBC Driver for SQL Server Spoofing Vulnerability

Affected: Microsoft JDBC Driver for SQL Server 10.2, Microsoft JDBC Driver for SQL Server 11.2, Microsoft JDBC Driver for SQL Server 12.10, Microsoft JDBC Driver for SQL Server 12.2, Microsoft JDBC Driver for SQL Server 12.4, Microsoft JDBC Driver for SQL Server 12.6, Microsoft JDBC Driver for SQL Server 12.8, Microsoft JDBC Driver for SQL Server 13.2

Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.

GHSA-2m67-wjpj-xhg9 — Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers

Affected: Maven: tools.jackson.core:jackson-core

## Summary

Jackson Core 3.x does not consistently enforce `StreamReadConstraints.maxDocumentLength`. Oversized JSON documents can be accepted without a `StreamConstraintsException` in multiple parser entry points, which allows configured size limits to be bypassed and weakens denial-of-service protections.

## Details

Three code paths where `maxDocumentLength` is not fully enforced:

### 1. Blocking parsers skip validation of the final in-memory buffer

Blocking parsers validate only previously processed buffers, not the final in-memory buffer:

- `ReaderBasedJsonParser.java:255` - `UTF8StreamJsonParser.java:208`

Relevant code:

```java _currInputProcessed += bufSize; _streamReadConstraints.validateDocumentLength(_currInputProcessed); ```

This means the check occurs only when a completed buffer is rolled over. If an oversized document is fully contained in the final buffer, parsing can complete without any document-length exception.

### 2. Async parsers skip validation of the final chunk on end-of-input

Async parsers validate previously processed chunks, but do not validate the final chunk on end-of-input:

- `NonBlockingByteArrayJsonParser.java:49` - `NonBlockingByteBufferJsonParser.java:57` - `NonBlockingUtf8JsonParserBase.java:75`

Relevant code:

```java _currInputProcessed += _origBufferLen; _streamReadConstraints.validateDocumentLength(_currInputProcessed);

public void endOfInput() { _endOfInput = true; } ```

`endOfInput()` marks EOF but does not perform a…

Most recent entries from all

CVE-2025-59250 — JDBC Driver for SQL Server Spoofing Vulnerability

GHSA-2m67-wjpj-xhg9 — Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers