Lookup for vulnerable packages by Package URL.
| Purl | pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.1 |
|---|
| Type | maven |
|---|
| Namespace | com.fasterxml.jackson.core |
|---|
| Name | jackson-core |
|---|
| Version | 2.21.1 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | false |
|---|
| Next_non_vulnerable_version | 2.18.6 |
|---|
| Latest_non_vulnerable_version | 2.21.1 |
|---|
| Affected_by_vulnerabilities |
|
|---|
| Fixing_vulnerabilities |
| 0 |
| url |
VCID-cnbh-vdhh-u3dy |
| vulnerability_id |
VCID-cnbh-vdhh-u3dy |
| summary |
jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition
The non-blocking (async) JSON parser in `jackson-core` bypasses the `maxNumberLength` constraint (default: 1000 characters) defined in `StreamReadConstraints`. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS).
The standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy. |
| references |
|
| fixed_packages |
|
| aliases |
GHSA-72hv-8253-57qq
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cnbh-vdhh-u3dy |
|
|
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.1 |
|---|