Seal Security

CVE-2020-36518

Deeply nested json in jackson-databind

jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack overflow exception and denial of service via a large depth of nested objects.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading

Vulnerability Details

Score

7.5

Score Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Versions

com.fasterxml.jackson.core:jackson-databind >= 2.13.0 < 2.13.2.1; com.fasterxml.jackson.core:jackson-databind < 2.12.6.1

Severity

High

Ecosystem

Publish Date

March 11, 2022

Modified Date

October 22, 2024