jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
References
| Link | Resource |
|---|---|
| https://github.com/FasterXML/jackson-databind/issues/3328 | Exploit Issue Tracking Vendor Advisory |
| https://groups.google.com/g/jackson-user/c/OsBsirPM_Vw | Mailing List Release Notes |
Configurations
Configuration 1 (hide)
|
History
08 Aug 2023, 14:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-770 |
Information
Published : 2023-03-18 22:15
Updated : 2024-02-28 20:13
NVD link : CVE-2021-46877
Mitre link : CVE-2021-46877
CVE.ORG link : CVE-2021-46877
JSON object : View
Products Affected
fasterxml
- jackson-databind
CWE
CWE-770
Allocation of Resources Without Limits or Throttling