com.fasterxml.jackson.core:jackson-databind 2.18.10

Direct Vulnerabilities

Known vulnerabilities in the com.fasterxml.jackson.core:jackson-databind package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Allocation of Resources Without Limits or Throttling com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `_findDeserializer()` method of `TypeDeserializerBase`, which caches every unknown type ID as a distinct key in the `_deserializers` map even when all of them resolve to the same `defaultImpl` fallback. An attacker can grow that cache without bound for the lifetime of the process, exhausting memory over time, by submitting a stream of novel type identifiers. This requires the application to use name-based polymorphism through `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, to accept attacker-controlled type identifiers, and to reuse the mapper instance across requests. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `com.fasterxml.jackson.core:jackson-databind` to version 2.18.11, 2.21.7, 2.22.3 or higher.	[,2.18.11)[2.19.0,2.21.7)[2.22.0,2.22.3)
H Allocation of Resources Without Limits or Throttling com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `resolveForwardReference()` method of `CollectionDeserializer.CollectionReferringAccumulator`, and in the corresponding map accumulators, which perform a linear search of the pending accumulator for every resolved object ID. An attacker can consume quadratic CPU and exhaust a request-time or worker-capacity budget by submitting JSON whose N unresolved object-ID references resolve in reverse order, costing roughly N*(N+1)/2 comparisons, measured at 2,003,000 for N=2,000. This requires the application to deserialize attacker-influenced JSON into an identity-enabled collection or map under `@JsonIdentityInfo`, though it needs no deep nesting or unusual JSON syntax. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `com.fasterxml.jackson.core:jackson-databind` to version 2.18.11, 2.21.7, 2.22.3 or higher.	[2.5.0,2.18.11)[2.19.0,2.21.7)[2.22.0,2.22.3)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the _findDeserializer() method of TypeDeserializerBase, which caches every unknown type ID as a distinct key in the _deserializers map even when all of them resolve to the same defaultImpl fallback. An attacker can grow that cache without bound for the lifetime of the process, exhausting memory over time, by submitting a stream of novel type identifiers. This requires the application to use name-based polymorphism through @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), to accept attacker-controlled type identifiers, and to reuse the mapper instance across requests.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.11, 2.21.7, 2.22.3 or higher.

[,2.18.11)[2.19.0,2.21.7)[2.22.0,2.22.3)

Allocation of Resources Without Limits or Throttling

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the resolveForwardReference() method of CollectionDeserializer.CollectionReferringAccumulator, and in the corresponding map accumulators, which perform a linear search of the pending accumulator for every resolved object ID. An attacker can consume quadratic CPU and exhaust a request-time or worker-capacity budget by submitting JSON whose N unresolved object-ID references resolve in reverse order, costing roughly N*(N+1)/2 comparisons, measured at 2,003,000 for N=2,000. This requires the application to deserialize attacker-influenced JSON into an identity-enabled collection or map under @JsonIdentityInfo, though it needs no deep nesting or unusual JSON syntax.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.11, 2.21.7, 2.22.3 or higher.

[2.5.0,2.18.11)[2.19.0,2.21.7)[2.22.0,2.22.3)

com.fasterxml.jackson.core:jackson-databind@2.18.10

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically