Read the docs
TI-2022-20342 Aliases CVE-2022-42003GHSA-jjjh-jjxp-wpff

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion…

Priority LOW 39CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution, Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 33 fixed, 17 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502 and CWE-400.

Summary

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03409 88th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.12.7.1, 2.13.4.2Red Hat: 32 advisoriesRed Hat: 33 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)2.4.0-rc1 to before 2.12.7.12.12.7.1Patch availableGHSA-jjjh-jjxp-wpff
—com.fasterxml.jackson.core:jackson-databind (Maven)2.13.0 to before 2.13.4.22.13.4.2Patch availableGHSA-jjjh-jjxp-wpff
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.4.0-rc1 to before 2.12.7.1 Fixed in 2.12.7.1 Patch available GHSA-jjjh-jjxp-wpff
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.13.0 to before 2.13.4.2 Fixed in 2.13.4.2 Patch available GHSA-jjjh-jjxp-wpff

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*before 2.12.7.1; 2.13.0 to before 2.13.4.1VulnerableFasterXML
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 2.13.3Vulnerablequarkusio
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions before 2.12.7.1; 2.13.0 to before 2.13.4.1 Vulnerable ·FasterXML
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 2.13.3 Vulnerable ·quarkusio
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-jjjh-jjxp-wpff com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.12.7.1 Advisory →
  • Fix · GHSA-jjjh-jjxp-wpff com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.13.4.2 Advisory →

Red Hat 32 advisories

  • RHSA-2025:1747 Released 2025-02-24 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.3.12 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hal-console-3.2.17-1.Final_redhat_00001.1.el7eap, eap7-jackson-annotations-2.10.4-2.redhat_00004.1.el7eap, eap7-jackson-core-2.10.4-2.redhat_00004.1.el7eap +38
  • RHSA-2025:1746 Released 2025-02-24 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-services-3.1.16-4.redhat_00003.1.ep7.el7 +26
  • RHSA-2023:3663 Released 2023-06-19 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1686831822-1.el8, jenkins-2.401.1.1686831596-3.el8
Show 29 more Red Hat advisories
  • RHSA-2023:3641 Released 2023-06-15 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release
    • RHINT Camel-Springboot 3.18.3.P2
  • RHSA-2023:3223 Released 2023-05-18 · Red Hat rating Important
    Red Hat AMQ Streams 2.4.0 release and security update
    • Red Hat AMQ Streams 2.4.0
  • RHSA-2023:2135 Released 2023-05-04 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.3 security update
    • RHPAM 7.13.1 async
  • RHSA-2023:2097 Released 2023-05-03 · Red Hat rating Important
    Satellite 6.13 Release
    • Red Hat Satellite 6.13 for RHEL 8 ansible-collection-redhat-satellite-3.9.0-2.el8sat, ansible-collection-redhat-satellite_operations-1.3.0-2.el8sat, ansible-lint-5.0.8-4.el8pc +47
  • RHSA-2023:2100 Released 2023-05-03 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.20.1 security update
    • RHINT Camel-Springboot 3.20.1
  • RHSA-2023:1006 Released 2023-03-08 · Red Hat rating Important
    Red Hat build of Quarkus 2.7.7 release and security update
    • Red Hat build of Quarkus 2.7.7
  • RHSA-2023:1151 Released 2023-03-07 · Red Hat rating Critical
    Satellite 6.11.5 Async Security Update
    • Red Hat Satellite 6.11 for RHEL 7 candlepin-4.1.19-1.el7sat, candlepin-selinux-4.1.19-1.el7sat, foreman-3.1.1.26-1.el7sat +42
    • Red Hat Satellite 6.11 for RHEL 8 candlepin-4.1.19-1.el8sat, candlepin-selinux-4.1.19-1.el8sat, foreman-3.1.1.26-1.el8sat +42
  • RHSA-2023:1064 Released 2023-03-06 · Red Hat rating Critical
    OpenShift Developer Tools and Services for OCP 4.12 security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1675702407-1.el8
  • RHSA-2023:1043 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
  • RHSA-2023:1049 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update
    • Red Hat Single Sign-On 7
  • RHSA-2023:1047 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2023:1045 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
  • RHSA-2023:1044 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
  • RHSA-2023:0713 Released 2023-02-09 · Red Hat rating Important
    Red Hat Data Grid 8.4.1 security update
    • Red Hat Data Grid 8.4.1
  • RHSA-2023:0556 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss Enterprise Application Platform 7.4.9 com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, com.fasterxml.woodstox.woodstox-core-6.4.0.redhat-00001.jar, org.apache.cxf.cxf-core-3.4.10.redhat-00001.jar +4
  • RHSA-2023:0554 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el9eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el9eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el9eap +44
  • RHSA-2023:0552 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.9.2-1.redhat_00001.1.el7eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el7eap +46
  • RHSA-2023:0553 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el8eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el8eap +44
  • RHSA-2023:0471 Released 2023-01-26 · Red Hat rating Important
    Migration Toolkit for Runtimes security update
    • Migration Toolkit for Runtimes 1 on RHEL 8
  • RHSA-2023:0469 Released 2023-01-26 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions For Quarkus 2.13.2
    • RHINT Camel-Q 2.13.2
  • RHSA-2023:0264 Released 2023-01-19 · Red Hat rating Moderate
    Red Hat OpenShift (Logging Subsystem) security update
    • RHOL 5.6 for RHEL 8 openshift-logging/elasticsearch6-rhel8, openshift-logging/logging-loki-rhel8, openshift-logging/logging-view-plugin-rhel8
  • RHSA-2023:0261 Released 2023-01-18 · Red Hat rating Critical
    Satellite 6.12.1 Async Security Update
    • Red Hat Satellite 6.12 for RHEL 8 candlepin-4.1.18-1.el8sat, candlepin-selinux-4.1.18-1.el8sat, foreman-3.3.0.18-1.el8sat +41
  • RHSA-2023:0189 Released 2023-01-17 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.3.0 release and security update
    • Red Hat AMQ Streams 2.3.0
  • RHSA-2022:9032 Released 2022-12-15 · Red Hat rating Important
    Red Hat build of Eclipse Vert.x 4.3.4 security update
    • Red Hat build of Eclipse Vert.x 4.3.4
  • RHSA-2022:9023 Released 2022-12-14 · Red Hat rating Important
    Red Hat build of Quarkus 2.13.5 release and security update
    • Red Hat build of Quarkus 2.13.5
  • RHSA-2022:8889 Released 2022-12-08 · Red Hat rating Moderate
    Openshift Logging 5.3.14 bug fix release and security update
    • OpenShift Logging 5.3 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +1
  • RHSA-2022:8781 Released 2022-12-08 · Red Hat rating Moderate
    Logging Subsystem 5.5.5 - Red Hat OpenShift security update
    • RHOL 5.5 for RHEL 8 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +3
  • RHSA-2022:8876 Released 2022-12-07 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.10.2 release and security update
    • Red Hat AMQ Broker 7
  • RHSA-2022:7435 Released 2022-11-16 · Red Hat rating Moderate
    Logging Subsystem 5.4.8 - Red Hat OpenShift security update
    • RHOL 5.4 for RHEL 8 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat Integration Service RegistryAffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Red Hat support for Spring BootAffectedNo fix planned: Will not fix
Middleware Containers for OpenShiftFixed RHSA-2023:1047
Migration Toolkit for Runtimes 1 on RHEL 8Fixed RHSA-2023:0471
OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8Fixed RHSA-2023:3663
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2023:1064
OpenShift Logging 5.3Fixed RHSA-2022:8889
RHINT Camel-Q 2.13.2Fixed RHSA-2023:0469
RHINT Camel-Springboot 3.18.3.P2Fixed RHSA-2023:3641
RHINT Camel-Springboot 3.20.1Fixed RHSA-2023:2100
RHOL 5.4 for RHEL 8Fixed RHSA-2022:7435
RHOL 5.5 for RHEL 8Fixed RHSA-2022:8781
RHOL 5.6 for RHEL 8Fixed RHSA-2023:0264
RHPAM 7.13.1 asyncFixed RHSA-2023:2135
Red Hat AMQ Broker 7Fixed RHSA-2022:8876
Red Hat AMQ Streams 2.3.0Fixed RHSA-2023:0189
Red Hat AMQ Streams 2.4.0Fixed RHSA-2023:3223
Red Hat Data Grid 8.4.1Fixed RHSA-2023:0713
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:0552
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:0553
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:1746
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:1747
Red Hat JBoss Enterprise Application Platform 7.4.9Fixed RHSA-2023:0556
Red Hat Satellite 6.11 for RHEL 7Fixed RHSA-2023:1151
Red Hat Satellite 6.11 for RHEL 8Fixed RHSA-2023:1151
Red Hat Satellite 6.12 for RHEL 8Fixed RHSA-2023:0261
Red Hat Satellite 6.13 for RHEL 8Fixed RHSA-2023:2097
Red Hat Single Sign-On 7Fixed RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2023:1045
Red Hat build of Eclipse Vert.x 4.3.4Fixed RHSA-2022:9032
Red Hat build of Quarkus 2.13.5Fixed RHSA-2022:9023
Red Hat build of Quarkus 2.7.7Fixed RHSA-2023:1006
Not affected: 18 products
  • A-MQ Clients 2
  • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • OpenShift Developer Tools and Services for OCP 4.12
  • OpenShift Logging 5.3
  • RHOL 5.4 for RHEL 8
  • RHOL 5.5 for RHEL 8
  • RHOL 5.6 for RHEL 8
  • Red Hat A-MQ Online
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • Red Hat JBoss Enterprise Application Platform 7.4.9
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Satellite 6
  • Red Hat Satellite 6.13 for RHEL 8
  • Red Hat build of Debezium 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-42003
  2. 2026-10-03 Alias added: GHSA-jjjh-jjxp-wpff
  3. 2026-10-07 CVSS score added · CISA ADP
  4. 2026-10-07 Weakness changed · CISA ADP
  5. 2026-10-07 CISA SSVC decision points changed
  6. 2026-11-05 Affected versions changed · Red Hat

References

Exploit 2

Patch 1

Advisory 5

Other 11

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences