CVE-2022-42003

HIGH
Published Oct 2, 20223y ago · Modified Jun 17, 20261w ago
7.5 CVSS 3.1
High
Find Similar
Published Oct 2, 2022 3y ago
Last Modified Jun 17, 2026 1w ago

Description

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-502 Deserialization of Untrusted Data Validation

Affected Products 6

VendorProductVersionRange
fasterxmljackson-databind* <2.12.7.1
fasterxmljackson-databind*≥2.13.0  –  <2.13.4.1
quarkusquarkus* <2.13.3
debiandebian_linux10.0any
debiandebian_linux11.0any
netapponcommand_workflow_automation*any

References 7

  • bugs.chromium.org https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020
    ExploitIssue TrackingMailing ListPatchThird Party Advisory
  • github.com https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33
    PatchThird Party Advisory
  • github.com https://github.com/FasterXML/jackson-databind/issues/3590
    ExploitIssue TrackingThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html
    Mailing ListThird Party Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/202210-21
    Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20221124-0004/
    Third Party Advisory
  • debian.org https://www.debian.org/security/2022/dsa-5283
    Third Party Advisory

Remediation

  • bugs.chromium.org https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020
    ExploitIssue TrackingMailing ListPatchThird Party Advisory
  • github.com https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33
    PatchThird Party Advisory