jackson-databind through 2.15.2 allows attackers to cause a denial of service or other…
Priority LOW 22CWE-770Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 6 fixed, 19 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-770.
Summary
jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.
Why it matters now
EPSS 0.00352 29th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 6 fixed, 19 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
Red Hat 6 advisories
- RHSA-2024:6893 Released 2024-09-19 · Red Hat rating ModerateRed Hat AMQ Broker 7.12.0 release and security update
- Red Hat AMQ Broker 7
- RHSA-2024:2707 Released 2024-05-06 · Red Hat rating ImportantRed Hat Build of Apache Camel security update
- Red Hat build of Apache Camel 4.4.0 for Spring Boot
- RHSA-2024:1027 Released 2024-02-28 · Red Hat rating ModerateMigration Toolkit for Applications security update
- MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-pathfinder-rhel9 +3
Show 3 more Red Hat advisories
- RHSA-2024:0777 Released 2024-02-12 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1706516441-1.el8, jenkins-2.426.3.1706516352-3.el8
- RHSA-2024:0719 Released 2024-02-07 · Red Hat rating ModerateMigration Toolkit for Runtimes security, bug fix and enhancement update
- Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-rhel8-operator, mtr/mtr-web-container-rhel8, mtr/mtr-web-executor-container-rhel8
- RHSA-2023:5396 Released 2023-09-28 · Red Hat rating ModerateRed Hat Data Grid 8.4.4 security update
- Red Hat Data Grid 8.4.4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 2 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse 6 | Affected | No fix yet |
| Red Hat OpenShift Application Runtimes | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of Debezium 1 | Affected | No fix yet |
| Red Hat build of Debezium 2 | Affected | No fix yet |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| streams for Apache Kafka | Affected | No fix yet |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2024:1027 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | Fixed | RHSA-2024:0719 |
| OpenShift Developer Tools and Services for OCP 4.14 | Fixed | RHSA-2024:0777 |
| Red Hat AMQ Broker 7 | Fixed | RHSA-2024:6893 |
| Red Hat Data Grid 8.4.4 | Fixed | RHSA-2023:5396 |
| Red Hat build of Apache Camel 4.4.0 for Spring Boot | Fixed | RHSA-2024:2707 |
Not affected: 8 products
- A-MQ Clients 2
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Runtimes 1 on RHEL 8
- Red Hat A-MQ Online
- Red Hat Integration Camel Quarkus 2
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2023-35116
- 2026-10-03 Alias added: GHSA-gx6w-fqg7-mc3p
References
More FasterXML Jackson-databind vulnerabilities
- TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
- TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2020-07095 FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI… CVSS 3.1CRITICAL 9.8
- TI-2026-39358 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation CVSS 3.1HIGH 8.1
- TI-2020-08560 A deserialization flaw was discovered in jackson-databind through 2.9.10.4. CVSS 3.1HIGH 8.1
- TI-2020-07635 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-35116 · CVE Program
- CVE-2023-35116 · NVD
- FIRST EPSS
- GHSA-gx6w-fqg7-mc3p · GitHub Advisory Database · CC BY 4.0
- CVE-2023-35116 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences