com.github.java-json-tools:jackson-coreutils 1.10

Direct Vulnerabilities

Known vulnerabilities in the com.github.java-json-tools:jackson-coreutils package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `tokensFromInput()` method of `TreePointer`, which parses JSON Pointer segments with repeated `substring()` calls that copy the remaining string each iteration (O(n^2)) and accumulates the parsed tokens into an unbounded `ArrayList`. An attacker can consume CPU quadratically and exhaust the JVM heap by supplying a JSON Pointer with a very large number of segments, on the order of 200,000 or more. This requires the application to parse an attacker-controlled JSON Pointer, which reaches this library through JSON Patch operations, JSON Schema references, or API parameters via json-schema-validator and json-patch. How to fix Allocation of Resources Without Limits or Throttling? There is no fixed version for `com.github.java-json-tools:jackson-coreutils`.	[0,)
H Server-side Request Forgery (SSRF) Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in `JsonLoader.fromURL()`, which fetches any URL without validation, and to memory amplification through `JacksonUtils.newMapper()`, which enables `WRITE_BIGDECIMAL_AS_PLAIN` so a `BigDecimal` serializes via `toPlainString()` with no size bound. An attacker can crash the JVM with an `OutOfMemoryError`, and reach internal services or local files, by getting the application to load a small JSON document such as `1e2000000000` whose plain-string serialization allocates roughly 2 GB. This requires the application to call `JsonLoader.fromURL()` with a user-controlled URL, or to parse untrusted JSON through the default mapper and then serialize it. How to fix Server-side Request Forgery (SSRF)? There is no fixed version for `com.github.java-json-tools:jackson-coreutils`.	[0,)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the tokensFromInput() method of TreePointer, which parses JSON Pointer segments with repeated substring() calls that copy the remaining string each iteration (O(n^2)) and accumulates the parsed tokens into an unbounded ArrayList. An attacker can consume CPU quadratically and exhaust the JVM heap by supplying a JSON Pointer with a very large number of segments, on the order of 200,000 or more. This requires the application to parse an attacker-controlled JSON Pointer, which reaches this library through JSON Patch operations, JSON Schema references, or API parameters via json-schema-validator and json-patch.

How to fix Allocation of Resources Without Limits or Throttling?

There is no fixed version for com.github.java-json-tools:jackson-coreutils.

[0,)

Server-side Request Forgery (SSRF)

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in JsonLoader.fromURL(), which fetches any URL without validation, and to memory amplification through JacksonUtils.newMapper(), which enables WRITE_BIGDECIMAL_AS_PLAIN so a BigDecimal serializes via toPlainString() with no size bound. An attacker can crash the JVM with an OutOfMemoryError, and reach internal services or local files, by getting the application to load a small JSON document such as 1e2000000000 whose plain-string serialization allocates roughly 2 GB. This requires the application to call JsonLoader.fromURL() with a user-controlled URL, or to parse untrusted JSON through the default mapper and then serialize it.

How to fix Server-side Request Forgery (SSRF)?

There is no fixed version for com.github.java-json-tools:jackson-coreutils.

[0,)

com.github.java-json-tools:jackson-coreutils@1.10

latest version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically