In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a…
Priority MEDIUM 45CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution, Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 30 fixed, 18 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502 and CWE-400.
Summary
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03409 88th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.12.7.1, 2.13.4Red Hat: 30 advisoriesRed Hat: 30 fixed, 18 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.4.0-rc1 to before 2.12.7.1 | 2.12.7.1 | Patch available | GHSA-rgv9-q543-rqg4 |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.13.0 to before 2.13.4 | 2.13.4 | Patch available | GHSA-rgv9-q543-rqg4 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.4.0-rc1 to before 2.12.7.1 Fixed in 2.12.7.1 Patch available GHSA-rgv9-q543-rqg4
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.13.0 to before 2.13.4 Fixed in 2.13.4 Patch available GHSA-rgv9-q543-rqg4
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | before 2.12.7.1; 2.13.0 to before 2.13.4 | Vulnerable | FasterXML |
| cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* | before 2.13.0 | Vulnerable | quarkusio |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions before 2.12.7.1; 2.13.0 to before 2.13.4 Vulnerable ·FasterXML
- cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 2.13.0 Vulnerable ·quarkusio
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-rgv9-q543-rqg4 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.12.7.1 Advisory →
- Fix · GHSA-rgv9-q543-rqg4 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.13.4 Advisory →
Red Hat 30 advisories
- RHSA-2025:1747 Released 2025-02-24 · Red Hat rating CriticalRed Hat JBoss Enterprise Application Platform 7.3.12 security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hal-console-3.2.17-1.Final_redhat_00001.1.el7eap, eap7-jackson-annotations-2.10.4-2.redhat_00004.1.el7eap, eap7-jackson-core-2.10.4-2.redhat_00004.1.el7eap +38
- RHSA-2025:1746 Released 2025-02-24 · Red Hat rating CriticalRed Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-services-3.1.16-4.redhat_00003.1.ep7.el7 +26
- RHSA-2023:3663 Released 2023-06-19 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1686831822-1.el8, jenkins-2.401.1.1686831596-3.el8
Show 27 more Red Hat advisories
- RHSA-2023:3641 Released 2023-06-15 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release
- RHINT Camel-Springboot 3.18.3.P2
- RHSA-2023:3223 Released 2023-05-18 · Red Hat rating ImportantRed Hat AMQ Streams 2.4.0 release and security update
- Red Hat AMQ Streams 2.4.0
- RHSA-2023:2135 Released 2023-05-04 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.3 security update
- RHPAM 7.13.1 async
- RHSA-2023:2097 Released 2023-05-03 · Red Hat rating ImportantSatellite 6.13 Release
- Red Hat Satellite 6.13 for RHEL 8 ansible-collection-redhat-satellite-3.9.0-2.el8sat, ansible-collection-redhat-satellite_operations-1.3.0-2.el8sat, ansible-lint-5.0.8-4.el8pc +47
- RHSA-2023:2100 Released 2023-05-03 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1
- RHSA-2023:1006 Released 2023-03-08 · Red Hat rating ImportantRed Hat build of Quarkus 2.7.7 release and security update
- Red Hat build of Quarkus 2.7.7
- RHSA-2023:1064 Released 2023-03-06 · Red Hat rating CriticalOpenShift Developer Tools and Services for OCP 4.12 security update
- OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1675702407-1.el8
- RHSA-2023:1043 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
- RHSA-2023:1049 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update
- Red Hat Single Sign-On 7
- RHSA-2023:1047 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2023:1045 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
- RHSA-2023:1044 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
- RHSA-2023:0713 Released 2023-02-09 · Red Hat rating ImportantRed Hat Data Grid 8.4.1 security update
- Red Hat Data Grid 8.4.1
- RHSA-2023:0556 Released 2023-01-31 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.9 Security update
- Red Hat JBoss Enterprise Application Platform 7.4.9 com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, com.fasterxml.woodstox.woodstox-core-6.4.0.redhat-00001.jar, org.apache.cxf.cxf-core-3.4.10.redhat-00001.jar +4
- RHSA-2023:0554 Released 2023-01-31 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.9 Security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el9eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el9eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el9eap +44
- RHSA-2023:0552 Released 2023-01-31 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.9 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.9.2-1.redhat_00001.1.el7eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el7eap +46
- RHSA-2023:0553 Released 2023-01-31 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.9 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el8eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el8eap +44
- RHSA-2023:0471 Released 2023-01-26 · Red Hat rating ImportantMigration Toolkit for Runtimes security update
- Migration Toolkit for Runtimes 1 on RHEL 8
- RHSA-2023:0469 Released 2023-01-26 · Red Hat rating ModerateRed Hat Integration Camel Extensions For Quarkus 2.13.2
- RHINT Camel-Q 2.13.2
- RHSA-2023:0264 Released 2023-01-19 · Red Hat rating ModerateRed Hat OpenShift (Logging Subsystem) security update
- RHOL 5.6 for RHEL 8 openshift-logging/elasticsearch6-rhel8, openshift-logging/logging-loki-rhel8, openshift-logging/logging-view-plugin-rhel8
- RHSA-2023:0189 Released 2023-01-17 · Red Hat rating ModerateRed Hat AMQ Streams 2.3.0 release and security update
- Red Hat AMQ Streams 2.3.0
- RHSA-2022:9032 Released 2022-12-15 · Red Hat rating ImportantRed Hat build of Eclipse Vert.x 4.3.4 security update
- Red Hat build of Eclipse Vert.x 4.3.4
- RHSA-2022:9023 Released 2022-12-14 · Red Hat rating ImportantRed Hat build of Quarkus 2.13.5 release and security update
- Red Hat build of Quarkus 2.13.5
- RHSA-2022:8889 Released 2022-12-08 · Red Hat rating ModerateOpenshift Logging 5.3.14 bug fix release and security update
- OpenShift Logging 5.3 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +1
- RHSA-2022:8781 Released 2022-12-08 · Red Hat rating ModerateLogging Subsystem 5.5.5 - Red Hat OpenShift security update
- RHOL 5.5 for RHEL 8 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +3
- RHSA-2022:8876 Released 2022-12-07 · Red Hat rating ModerateRed Hat AMQ Broker 7.10.2 release and security update
- Red Hat AMQ Broker 7
- RHSA-2022:7435 Released 2022-11-16 · Red Hat rating ModerateLogging Subsystem 5.4.8 - Red Hat OpenShift security update
- RHOL 5.4 for RHEL 8 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat Integration Service Registry | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat support for Spring Boot | Affected | No fix planned: Will not fix |
| Middleware Containers for OpenShift | Fixed | RHSA-2023:1047 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | Fixed | RHSA-2023:0471 |
| OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 | Fixed | RHSA-2023:3663 |
| OpenShift Developer Tools and Services for OCP 4.12 | Fixed | RHSA-2023:1064 |
| OpenShift Logging 5.3 | Fixed | RHSA-2022:8889 |
| RHINT Camel-Q 2.13.2 | Fixed | RHSA-2023:0469 |
| RHINT Camel-Springboot 3.18.3.P2 | Fixed | RHSA-2023:3641 |
| RHINT Camel-Springboot 3.20.1 | Fixed | RHSA-2023:2100 |
| RHOL 5.4 for RHEL 8 | Fixed | RHSA-2022:7435 |
| RHOL 5.5 for RHEL 8 | Fixed | RHSA-2022:8781 |
| RHOL 5.6 for RHEL 8 | Fixed | RHSA-2023:0264 |
| RHPAM 7.13.1 async | Fixed | RHSA-2023:2135 |
| Red Hat AMQ Broker 7 | Fixed | RHSA-2022:8876 |
| Red Hat AMQ Streams 2.3.0 | Fixed | RHSA-2023:0189 |
| Red Hat AMQ Streams 2.4.0 | Fixed | RHSA-2023:3223 |
| Red Hat Data Grid 8.4.1 | Fixed | RHSA-2023:0713 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2023:0552 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2023:0553 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2023:0554 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2025:1746 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:1747 |
| Red Hat JBoss Enterprise Application Platform 7.4.9 | Fixed | RHSA-2023:0556 |
| Red Hat Satellite 6.13 for RHEL 8 | Fixed | RHSA-2023:2097 |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2023:1049 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2023:1043 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2023:1044 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2023:1045 |
| Red Hat build of Eclipse Vert.x 4.3.4 | Fixed | RHSA-2022:9032 |
| Red Hat build of Quarkus 2.13.5 | Fixed | RHSA-2022:9023 |
| Red Hat build of Quarkus 2.7.7 | Fixed | RHSA-2023:1006 |
Not affected: 19 products
- A-MQ Clients 2
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
- OpenShift Developer Tools and Services for OCP 4.12
- OpenShift Logging 5.3
- RHOL 5.4 for RHEL 8
- RHOL 5.5 for RHEL 8
- RHOL 5.6 for RHEL 8
- Red Hat A-MQ Online
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
- Red Hat JBoss Enterprise Application Platform 7.4.9
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Dev Spaces
- Red Hat Satellite 6
- Red Hat Satellite 6.13 for RHEL 8
- Red Hat build of Debezium 1
Timeline
- 2026-10-02 Threatist record created from CVE-2022-42004
- 2026-10-03 Alias added: GHSA-rgv9-q543-rqg4
- 2026-10-07 CVSS score added · CISA ADP
- 2026-10-07 Weakness changed · CISA ADP
- 2026-10-07 CISA SSVC decision points changed
- 2026-10-07 Priority changed: LOW → MEDIUM
- 2026-11-05 Affected versions changed · Red Hat
References
Exploit 2
Patch 1
Advisory 5
Other 5
- https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1
- https://github.com/FasterXML/jackson-databind/commit/35de19e7144c4df8ab178b800ba86e80c3d84252
- https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea
- https://github.com/FasterXML/jackson-databind
- https://security.netapp.com/advisory/ntap-20221118-0008
Sources
- CVE-2022-42004 · CVE Program
- CVE-2022-42004 · NVD
- FIRST EPSS
- GHSA-rgv9-q543-rqg4 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-42004 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences