jackson-databind: use of deeply nested arrays
Published Oct 2, 2022
8.2
HIGHCVSS 4.0
EPSS 3.41%
Description
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
Affected products
No data.
Configuration 1
- < 2.12.7.1
- ≥ 2.13.0 · < 2.13.4
Configuration 3
- 10.0
- 11.0
Configuration 4
- n/a
No data.
Logging subsystem for Red Hat OpenShift 5.4
openshift-logging/elasticsearch-operator-bundle:v5.4.8-11
Fixed · RHSA-2022:7435
Logging subsystem for Red Hat OpenShift 5.4
openshift-logging/elasticsearch-proxy-rhel8:v1.0.0-300
Fixed · RHSA-2022:7435
Logging subsystem for Red Hat OpenShift 5.4
openshift-logging/elasticsearch-rhel8-operator:v5.4.8-3
Fixed · RHSA-2022:7435
Logging subsystem for Red Hat OpenShift 5.4
openshift-logging/elasticsearch6-rhel8:v6.8.1-265
Fixed · RHSA-2022:7435
Migration Toolkit for Runtimes 1 on RHEL 8
jackson-databind
Fixed · RHSA-2023:0471
OCP-Tools-4.12-RHEL-8
jenkins-2-plugins-0:4.12.1675702407-1.el8
Fixed · RHSA-2023:1064
OpenShift Developer Tools and Services for OCP 4.11
jenkins-2-plugins-0:4.11.1686831822-1.el8
Fixed · RHSA-2023:3663
OpenShift Logging 5.3
openshift-logging/elasticsearch-operator-bundle:v5.3.14-16
Fixed · RHSA-2022:8889
OpenShift Logging 5.3
openshift-logging/elasticsearch-proxy-rhel8:v1.0.0-315
Fixed · RHSA-2022:8889
OpenShift Logging 5.3
openshift-logging/elasticsearch-rhel8-operator:v5.3.14-5
Fixed · RHSA-2022:8889
OpenShift Logging 5.3
openshift-logging/elasticsearch6-rhel8:v6.8.1-277
Fixed · RHSA-2022:8889
RHEL-8 based Middleware Containers
rh-sso-7/sso76-openshift-rhel8:7.6-20
Fixed · RHSA-2023:1047
RHINT Camel-Q 2.13.2
jackson-databind
Fixed · RHSA-2023:0469
RHINT Camel-Springboot 3.18.3.P2
jackson-databind
Fixed · RHSA-2023:3641
RHINT Camel-Springboot 3.20.1
jackson-databind
Fixed · RHSA-2023:2100
RHOL-5.5-RHEL-8
openshift-logging/elasticsearch-operator-bundle:v5.5.5-14
Fixed · RHSA-2022:8781
RHOL-5.5-RHEL-8
openshift-logging/elasticsearch-proxy-rhel8:v1.0.0-311
Fixed · RHSA-2022:8781
RHOL-5.5-RHEL-8
openshift-logging/elasticsearch-rhel8-operator:v5.5.5-2
Fixed · RHSA-2022:8781
RHOL-5.5-RHEL-8
openshift-logging/elasticsearch6-rhel8:v6.8.1-273
Fixed · RHSA-2022:8781
RHOL-5.6-RHEL-8
openshift-logging/elasticsearch6-rhel8:v6.8.1-285
Fixed · RHSA-2023:0264
RHPAM 7.13.1 async
jackson-databind
Fixed · RHSA-2023:2135
Red Hat AMQ Broker 7
jackson-databind
Fixed · RHSA-2022:8876
Red Hat AMQ Streams 2.3.0
jackson-databind
Fixed · RHSA-2023:0189
Red Hat AMQ Streams 2.4.0
n/a
Fixed · RHSA-2023:3223
Red Hat Data Grid 8.4.1
jackson-databind
Fixed · RHSA-2023:0713
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7
Fixed · RHSA-2025:1746
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7
Fixed · RHSA-2025:1746
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap
Fixed · RHSA-2025:1747
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap
Fixed · RHSA-2025:1747
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap
Fixed · RHSA-2025:1747
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el8eap
Fixed · RHSA-2023:0553
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap
Fixed · RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap
Fixed · RHSA-2023:0552
Red Hat JBoss Enterprise Application Platform 7.4.9
com.fasterxml.jackson.core/jackson-databind:2.12.7.redhat-00003
Fixed · RHSA-2023:0556
Red Hat Satellite 6.13 for RHEL 8
candlepin-0:4.2.13-1.el8sat
Fixed · RHSA-2023:2097
Red Hat Single Sign-On 7
jackson-databind
Fixed · RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7
rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso
Fixed · RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8
rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso
Fixed · RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9
rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso
Fixed · RHSA-2023:1045
Red Hat build of Eclipse Vert.x 4.3.4
jackson-databind
Fixed · RHSA-2022:9032
Red Hat build of Quarkus 2.13.5
jackson-databind
Fixed · RHSA-2022:9023
Red Hat build of Quarkus 2.7.7
n/a
Fixed · RHSA-2023:1006
A-MQ Clients 2
jackson-databind
Not affected
Red Hat A-MQ Online
jackson-databind
Not affected
Red Hat Enterprise Linux 8
jackson-databind
Affected
Red Hat Enterprise Linux 8
pki-deps:10.6/jackson-databind
Will not fix
Red Hat Enterprise Linux 9
jackson-databind
Will not fix
Red Hat Fuse 7
jackson-databind
Will not fix
Red Hat Integration Camel K 1
jackson-databind
Affected
Red Hat Integration Service Registry
jackson-databind
Out of support scope
Red Hat JBoss Data Grid 7
jackson-databind
Out of support scope
Red Hat JBoss Data Virtualization 6
jackson-databind
Out of support scope
Red Hat JBoss Enterprise Application Platform 6
jackson-databind
Out of support scope
Red Hat JBoss Enterprise Application Platform 6
jboss-on
Out of support scope
Red Hat JBoss Enterprise Application Platform 6
keycloak-adapter-eap6
Out of support scope
Red Hat JBoss Enterprise Application Platform 6
keycloak-adapter-sso7_2-eap6
Out of support scope
Red Hat JBoss Enterprise Application Platform 6
keycloak-adapter-sso7_3-eap6
Out of support scope
Red Hat JBoss Enterprise Application Platform 6
keycloak-adapter-sso7_4-eap6
Out of support scope
Red Hat JBoss Enterprise Application Platform 6
keycloak-adapter-sso7_5-eap6
Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion Pack
jackson-databind
Not affected
Red Hat JBoss Fuse 6
jackson-databind
Out of support scope
Red Hat JBoss Fuse Service Works 6
jackson-databind
Out of support scope
Red Hat OpenShift Application Runtimes
jackson-databind
Affected
Red Hat OpenShift Container Platform 3.11
jenkins-2-plugins
Out of support scope
Red Hat OpenShift Container Platform 4
jenkins-2-plugins
Affected
Red Hat OpenShift Dev Spaces
devspaces/server-rhel8
Affected
Red Hat OpenShift Dev Spaces
devspaces/udi-rhel8
Not affected
Red Hat OpenStack Platform 13 (Queens)
opendaylight
Out of support scope
Red Hat Satellite 6
puppetserver
Not affected
Red Hat build of Apicurio Registry 2
jackson-databind
Affected
Red Hat build of Debezium 1
jackson-databind
Not affected
Red Hat support for Spring Boot
jackson-databind
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Logging subsystem for Red Hat OpenShift 5.4 | openshift-logging/elasticsearch-operator-bundle:v5.4.8-11 | Fixed | RHSA-2022:7435 |
| Logging subsystem for Red Hat OpenShift 5.4 | openshift-logging/elasticsearch-proxy-rhel8:v1.0.0-300 | Fixed | RHSA-2022:7435 |
| Logging subsystem for Red Hat OpenShift 5.4 | openshift-logging/elasticsearch-rhel8-operator:v5.4.8-3 | Fixed | RHSA-2022:7435 |
| Logging subsystem for Red Hat OpenShift 5.4 | openshift-logging/elasticsearch6-rhel8:v6.8.1-265 | Fixed | RHSA-2022:7435 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | jackson-databind | Fixed | RHSA-2023:0471 |
| OCP-Tools-4.12-RHEL-8 | jenkins-2-plugins-0:4.12.1675702407-1.el8 | Fixed | RHSA-2023:1064 |
| OpenShift Developer Tools and Services for OCP 4.11 | jenkins-2-plugins-0:4.11.1686831822-1.el8 | Fixed | RHSA-2023:3663 |
| OpenShift Logging 5.3 | openshift-logging/elasticsearch-operator-bundle:v5.3.14-16 | Fixed | RHSA-2022:8889 |
| OpenShift Logging 5.3 | openshift-logging/elasticsearch-proxy-rhel8:v1.0.0-315 | Fixed | RHSA-2022:8889 |
| OpenShift Logging 5.3 | openshift-logging/elasticsearch-rhel8-operator:v5.3.14-5 | Fixed | RHSA-2022:8889 |
| OpenShift Logging 5.3 | openshift-logging/elasticsearch6-rhel8:v6.8.1-277 | Fixed | RHSA-2022:8889 |
| RHEL-8 based Middleware Containers | rh-sso-7/sso76-openshift-rhel8:7.6-20 | Fixed | RHSA-2023:1047 |
| RHINT Camel-Q 2.13.2 | jackson-databind | Fixed | RHSA-2023:0469 |
| RHINT Camel-Springboot 3.18.3.P2 | jackson-databind | Fixed | RHSA-2023:3641 |
| RHINT Camel-Springboot 3.20.1 | jackson-databind | Fixed | RHSA-2023:2100 |
| RHOL-5.5-RHEL-8 | openshift-logging/elasticsearch-operator-bundle:v5.5.5-14 | Fixed | RHSA-2022:8781 |
| RHOL-5.5-RHEL-8 | openshift-logging/elasticsearch-proxy-rhel8:v1.0.0-311 | Fixed | RHSA-2022:8781 |
| RHOL-5.5-RHEL-8 | openshift-logging/elasticsearch-rhel8-operator:v5.5.5-2 | Fixed | RHSA-2022:8781 |
| RHOL-5.5-RHEL-8 | openshift-logging/elasticsearch6-rhel8:v6.8.1-273 | Fixed | RHSA-2022:8781 |
| RHOL-5.6-RHEL-8 | openshift-logging/elasticsearch6-rhel8:v6.8.1-285 | Fixed | RHSA-2023:0264 |
| RHPAM 7.13.1 async | jackson-databind | Fixed | RHSA-2023:2135 |
| Red Hat AMQ Broker 7 | jackson-databind | Fixed | RHSA-2022:8876 |
| Red Hat AMQ Streams 2.3.0 | jackson-databind | Fixed | RHSA-2023:0189 |
| Red Hat AMQ Streams 2.4.0 | n/a | Fixed | RHSA-2023:3223 |
| Red Hat Data Grid 8.4.1 | jackson-databind | Fixed | RHSA-2023:0713 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7 | Fixed | RHSA-2025:1746 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | Fixed | RHSA-2025:1746 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap | Fixed | RHSA-2025:1747 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap | Fixed | RHSA-2025:1747 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap | Fixed | RHSA-2025:1747 |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el8eap | Fixed | RHSA-2023:0553 |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap | Fixed | RHSA-2023:0554 |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap | Fixed | RHSA-2023:0552 |
| Red Hat JBoss Enterprise Application Platform 7.4.9 | com.fasterxml.jackson.core/jackson-databind:2.12.7.redhat-00003 | Fixed | RHSA-2023:0556 |
| Red Hat Satellite 6.13 for RHEL 8 | candlepin-0:4.2.13-1.el8sat | Fixed | RHSA-2023:2097 |
| Red Hat Single Sign-On 7 | jackson-databind | Fixed | RHSA-2023:1049 |
| Red Hat Single Sign-On 7.6 for RHEL 7 | rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso | Fixed | RHSA-2023:1043 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso | Fixed | RHSA-2023:1044 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso | Fixed | RHSA-2023:1045 |
| Red Hat build of Eclipse Vert.x 4.3.4 | jackson-databind | Fixed | RHSA-2022:9032 |
| Red Hat build of Quarkus 2.13.5 | jackson-databind | Fixed | RHSA-2022:9023 |
| Red Hat build of Quarkus 2.7.7 | n/a | Fixed | RHSA-2023:1006 |
| A-MQ Clients 2 | jackson-databind | Not affected | n/a |
| Red Hat A-MQ Online | jackson-databind | Not affected | n/a |
| Red Hat Enterprise Linux 8 | jackson-databind | Affected | n/a |
| Red Hat Enterprise Linux 8 | pki-deps:10.6/jackson-databind | Will not fix | n/a |
| Red Hat Enterprise Linux 9 | jackson-databind | Will not fix | n/a |
| Red Hat Fuse 7 | jackson-databind | Will not fix | n/a |
| Red Hat Integration Camel K 1 | jackson-databind | Affected | n/a |
| Red Hat Integration Service Registry | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss Data Grid 7 | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss Data Virtualization 6 | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | jboss-on | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | keycloak-adapter-eap6 | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | keycloak-adapter-sso7_2-eap6 | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | keycloak-adapter-sso7_3-eap6 | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | keycloak-adapter-sso7_4-eap6 | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | keycloak-adapter-sso7_5-eap6 | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | jackson-databind | Not affected | n/a |
| Red Hat JBoss Fuse 6 | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss Fuse Service Works 6 | jackson-databind | Out of support scope | n/a |
| Red Hat OpenShift Application Runtimes | jackson-databind | Affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | jenkins-2-plugins | Out of support scope | n/a |
| Red Hat OpenShift Container Platform 4 | jenkins-2-plugins | Affected | n/a |
| Red Hat OpenShift Dev Spaces | devspaces/server-rhel8 | Affected | n/a |
| Red Hat OpenShift Dev Spaces | devspaces/udi-rhel8 | Not affected | n/a |
| Red Hat OpenStack Platform 13 (Queens) | opendaylight | Out of support scope | n/a |
| Red Hat Satellite 6 | puppetserver | Not affected | n/a |
| Red Hat build of Apicurio Registry 2 | jackson-databind | Affected | n/a |
| Red Hat build of Debezium 1 | jackson-databind | Not affected | n/a |
| Red Hat support for Spring Boot | jackson-databind | Will not fix | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (19 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 3.41% (0.03409) | 88.49th | v5 (v2026.06.15) |
| Jun 15, 2026 | 2.66% (0.02656) | 83.65th | v5 (v2026.06.15) |
| Nov 21, 2025 | 0.30% (0.00303) | 53.15th | v4 (v2025.03.14) |
| Nov 18, 2025 | 1.65% (0.01645) | 80.45th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.24% (0.00239) | 45.05th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.26% (0.00264) | 66.57th | v3 (v2023.03.01) |
| May 23, 2024 | 0.26% (0.00264) | 66.09th | v3 (v2023.03.01) |
| Apr 24, 2024 | 0.24% (0.00242) | 63.97th | v3 (v2023.03.01) |
| Mar 14, 2024 | 0.21% (0.00214) | 58.86th | v3 (v2023.03.01) |
| Jan 7, 2024 | 0.18% (0.00181) | 55.28th | v3 (v2023.03.01) |
| Nov 4, 2023 | 0.17% (0.00172) | 54.21th | v3 (v2023.03.01) |
| Oct 9, 2023 | 0.14% (0.00143) | 49.70th | v3 (v2023.03.01) |
| Sep 2, 2023 | 0.09% (0.00093) | 38.83th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.08% (0.00078) | 32.15th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.11% (0.01108) | 55.18th | v2 (v2022.01.01) |
| Nov 19, 2022 | 1.11% (0.01108) | 53.99th | v2 (v2022.01.01) |
| Oct 31, 2022 | 1.02% (0.01018) | 39.36th | v2 (v2022.01.01) |
| Oct 5, 2022 | 0.95% (0.00954) | 34.85th | v2 (v2022.01.01) |
| Oct 2, 2022 | 0.89% (0.00890) | 28.87th | v2 (v2022.01.01) |
References (15)
- https://access.redhat.com/security/cve/CVE-2022-42004 Vendor Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50490 ExploitIssue TrackingMailing ListPatchThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2135247 Issue Tracking
- https://github.com/FasterXML/jackson-databind/commit/063183589218fec19a9293ed2f17ec53ea80ba88 PatchThird Party Advisory
- https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1
- https://github.com/FasterXML/jackson-databind/commit/35de19e7144c4df8ab178b800ba86e80c3d84252
- https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea
- https://github.com/FasterXML/jackson-databind/issues/3582 ExploitIssue TrackingThird Party Advisory
- https://github.com/advisories/GHSA-rgv9-q543-rqg4 Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html mailing-listMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-42004
- https://security.gentoo.org/glsa/202210-21 vendor-advisoryThird Party Advisory
- https://security.netapp.com/advisory/ntap-20221118-0008 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-42004
- https://www.debian.org/security/2022/dsa-5283 vendor-advisoryThird Party Advisory
Change history (0)
No recorded changes yet.