Vulnerabilities |
4 via 9 paths |
|---|---|
Dependencies |
21 |
Source |
GitHub |
Find, fix and prevent vulnerabilities in your code.
critical severity
new
- Vulnerable module: tools.jackson.core:jackson-databind
- Introduced through: tools.jackson.core:jackson-databind@3.2.2 and tools.jackson.dataformat:jackson-dataformat-xml@3.2.2
Detailed paths
-
Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.core:jackson-databind@3.2.2Remediation: Upgrade to tools.jackson.core:jackson-databind@3.2.4.
-
Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.dataformat:jackson-dataformat-xml@3.2.2 › tools.jackson.core:jackson-databind@3.2.2Remediation: Upgrade to tools.jackson.dataformat:jackson-dataformat-xml@3.2.4.
Overview
Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the _resolveAndValidateGeneric() and _validateTypeParameter() methods of the DatabindContext class. An attacker can instantiate arbitrary classes by supplying a class-name type ID whose generic arguments or array element type name a class that is not validated, because only the outer type is checked against the PolymorphicTypeValidator. Exploitation requires deserializing untrusted JSON with class-name type IDs, through annotation-based polymorphism or default typing, where the outer base type is approved, and a usable gadget class is on the classpath.
Workaround
This vulnerability can be avoided by using narrow subtype rules, preventing attackers from writing serialized cache or session values, or removing unnecessary dependencies that provide gadget classes.
Note: This is a bypass of the fix for the vulnerability described in CVE-2026-54512.
Details
Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.
Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.
Remediation
Upgrade tools.jackson.core:jackson-databind to version 3.1.8, 3.2.4 or higher.
References
high severity
- Vulnerable module: tools.jackson.core:jackson-core
- Introduced through: tools.jackson.core:jackson-databind@3.2.2 and tools.jackson.dataformat:jackson-dataformat-xml@3.2.2
Detailed paths
-
Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.core:jackson-databind@3.2.2 › tools.jackson.core:jackson-core@3.2.2Remediation: Upgrade to tools.jackson.core:jackson-databind@3.2.3.
-
Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.dataformat:jackson-dataformat-xml@3.2.2 › tools.jackson.core:jackson-core@3.2.2Remediation: Upgrade to tools.jackson.dataformat:jackson-dataformat-xml@3.2.3.
-
Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.dataformat:jackson-dataformat-xml@3.2.2 › tools.jackson.core:jackson-databind@3.2.2 › tools.jackson.core:jackson-core@3.2.2Remediation: Upgrade to tools.jackson.dataformat:jackson-dataformat-xml@3.2.3.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the _reportInvalidToken(int, String, String) method of UTF8DataInputJsonParser, which accumulates invalid token characters into a StringBuilder with no check against ErrorReportConfiguration.getMaxErrorTokenLength(), unlike UTF8StreamJsonParser, ReaderBasedJsonParser, and NonBlockingUtf8JsonParserBase, which enforce the 256-character default. An attacker can exhaust the JVM heap by submitting a sufficiently long malformed token, since the whole token is copied into the exception message, where a 20-million-character token produces a 20,000,109-character message against 367 characters on the bounded path. This requires the application to create its parser through JsonFactory.createParser(DataInput), and no configuration constrains the path, since maxDocumentLength does not apply to DataInput sources and maxStringLength does not cover it.
Remediation
Upgrade tools.jackson.core:jackson-core to version 3.1.7, 3.2.3 or higher.
References
high severity
- Vulnerable module: tools.jackson.core:jackson-databind
- Introduced through: tools.jackson.core:jackson-databind@3.2.2 and tools.jackson.dataformat:jackson-dataformat-xml@3.2.2
Detailed paths
-
Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.core:jackson-databind@3.2.2Remediation: Upgrade to tools.jackson.core:jackson-databind@3.2.3.
-
Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.dataformat:jackson-dataformat-xml@3.2.2 › tools.jackson.core:jackson-databind@3.2.2Remediation: Upgrade to tools.jackson.dataformat:jackson-dataformat-xml@3.2.3.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the resolveForwardReference() method of CollectionDeserializer.CollectionReferringAccumulator, and in the corresponding map accumulators, which perform a linear search of the pending accumulator for every resolved object ID. An attacker can consume quadratic CPU and exhaust a request-time or worker-capacity budget by submitting JSON whose N unresolved object-ID references resolve in reverse order, costing roughly N*(N+1)/2 comparisons, measured at 2,003,000 for N=2,000. This requires the application to deserialize attacker-influenced JSON into an identity-enabled collection or map under @JsonIdentityInfo, though it needs no deep nesting or unusual JSON syntax.
Remediation
Upgrade tools.jackson.core:jackson-databind to version 3.1.7, 3.2.3 or higher.
References
medium severity
- Vulnerable module: tools.jackson.core:jackson-databind
- Introduced through: tools.jackson.core:jackson-databind@3.2.2 and tools.jackson.dataformat:jackson-dataformat-xml@3.2.2
Detailed paths
-
Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.core:jackson-databind@3.2.2Remediation: Upgrade to tools.jackson.core:jackson-databind@3.2.3.
-
Introduced through: Cantara/lib-electronic-components@Cantara/lib-electronic-components › tools.jackson.dataformat:jackson-dataformat-xml@3.2.2 › tools.jackson.core:jackson-databind@3.2.2Remediation: Upgrade to tools.jackson.dataformat:jackson-dataformat-xml@3.2.3.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the _findDeserializer() method of TypeDeserializerBase, which caches every unknown type ID as a distinct key in the _deserializers map even when all of them resolve to the same defaultImpl fallback. An attacker can grow that cache without bound for the lifetime of the process, exhausting memory over time, by submitting a stream of novel type identifiers. This requires the application to use name-based polymorphism through @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), to accept attacker-controlled type identifiers, and to reuse the mapper instance across requests.
Remediation
Upgrade tools.jackson.core:jackson-databind to version 3.1.7, 3.2.3 or higher.