CVE-2022-42003: Uncontrolled Resource Consumption in Jackson-databind

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-02 · updated 2026-10-07
Weakness: CWE-502

Description

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

Affected products

Debian Linux: 10.0, 11.0
FasterXML jackson-databind: before 2.12.7.1; from 2.13.0 before 2.13.4.1 — fixed in 2.12.7.1, 2.13.4.1
NetApp OnCommand Workflow Automation: all versions
quarkusio quarkus: before 2.13.3 — fixed in 2.13.3
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.4.0-rc1 before 2.12.7.1; from 2.13.0 before 2.13.4.2; 2.10.0, 2.10.0.pr1, 2.10.0.pr2, 2.10.0.pr3, 2.10.1, 2.10.2 (+136) — fixed in 2.12.7.1, 2.13.4.2

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.12.7.1, 2.13.4.1; quarkusio quarkus 2.13.3; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.12.7.1, 2.13.4.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-42003 or the next vulnerability affects your stack