Release Date: | 2025-06-25 | |
Impact: | Important | What is this? |
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.
See more information about CVE-2025-52999 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS metrics and score provided are preliminary and subject to review.
Base Score: | 7.5 |
Vector String: | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Version: | 3.1 |
Attack Vector: | Network |
Attack Complexity: | Low |
Privileges Required: | None |
User Interaction: | None |
Scope: | Unchanged |
Confidentiality Impact: | None |
Integrity Impact: | None |
Availability Impact: | High |
Platform | Errata | Release Date |
Oracle Linux version 8 (apache-commons-collections) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (apache-commons-lang) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (apache-commons-net) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (bea-stax) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (fasterxml-oss-parent) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (glassfish-fastinfoset) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (glassfish-jaxb) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (glassfish-jaxb-api) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (jackson-annotations) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (jackson-bom) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (jackson-core) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (jackson-databind) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (jackson-jaxrs-providers) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (jackson-modules-base) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (jackson-parent) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (jakarta-commons-httpclient) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (javassist) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (pki-servlet-engine) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (relaxngDatatype) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (slf4j) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (stax-ex) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (velocity) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (xalan-j2) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (xerces-j2) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (xml-commons-apis) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (xml-commons-resolver) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (xmlstreambuffer) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 8 (xsom) | ELSA-2025-14126 | 2025-08-22 |
Oracle Linux version 9 (jackson-annotations) | ELSA-2025-12280 | 2025-07-30 |
Oracle Linux version 9 (jackson-core) | ELSA-2025-12280 | 2025-07-30 |
Oracle Linux version 9 (jackson-databind) | ELSA-2025-12280 | 2025-07-30 |
Oracle Linux version 9 (jackson-jaxrs-providers) | ELSA-2025-12280 | 2025-07-30 |
Oracle Linux version 9 (jackson-modules-base) | ELSA-2025-12280 | 2025-07-30 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections: