CVE-2022-42004: Uncontrolled Resource Consumption in FasterXML jackson-databind

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-02 · updated 2026-10-07
Weakness: CWE-502

Description

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

Affected products

Debian Linux: 10.0, 11.0
FasterXML jackson-databind: before 2.12.7.1; from 2.13.0 before 2.13.4 — fixed in 2.12.7.1, 2.13.4
NetApp OnCommand Workflow Automation: all versions
quarkusio quarkus: before 2.13.0 — fixed in 2.13.0
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.4.0-rc1 before 2.12.7.1; from 2.13.0 before 2.13.4; 2.10.0, 2.10.0.pr1, 2.10.0.pr2, 2.10.0.pr3, 2.10.1, 2.10.2 (+134) — fixed in 2.12.7.1, 2.13.4

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.12.7.1, 2.13.4; quarkusio quarkus 2.13.0; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.12.7.1, 2.13.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-42004 or the next vulnerability affects your stack