jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

Project Subscriptions

Vendors Products
Fasterxml Subscribe
Jackson-databind Subscribe
Amq Streams Subscribe
Camel Spring Boot Subscribe
Jboss Enterprise Application Platform Subscribe
Migration Toolkit Applications Subscribe
Migration Toolkit Runtimes Subscribe
Ocp Tools Subscribe
Openshift Application Runtimes Subscribe
Red Hat Single Sign On Subscribe
Rhosemc Subscribe
Satellite Subscribe
Satellite Capsule Subscribe
Satellite Maintenance Subscribe
Satellite Utils Subscribe
Service Registry Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-0856 jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
Github GHSA Github GHSA GHSA-3x8x-79m2-3w2w jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00097}

epss

{'score': 0.00099}


Thu, 10 Apr 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat satellite Maintenance
Redhat satellite Utils
CPEs cpe:/a:redhat:satellite_maintenance:6.13::el8
cpe:/a:redhat:satellite_utils:6.13::el8
Vendors & Products Redhat satellite Maintenance
Redhat satellite Utils

Tue, 04 Mar 2025 03:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-02-26T19:02:21.440Z

Reserved: 2023-03-18T00:00:00.000Z

Link: CVE-2021-46877

cve-icon Vulnrichment

Updated: 2024-08-04T05:17:42.837Z

cve-icon NVD

Status : Modified

Published: 2023-03-18T22:15:11.357

Modified: 2025-02-26T19:15:12.823

Link: CVE-2021-46877

cve-icon Redhat

Severity : Moderate

Publid Date: 2023-03-19T00:00:00Z

Links: CVE-2021-46877 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses