CVE-2022-42004

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-42004
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42004.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-42004
Aliases
Downstream
CGA (249)
CLSA (1)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (5)
OESA (2)
openSUSE (1)
RHSA (11)
RLSA (1)
ROOT (1)
SUSE (1)
UBUNTU (1)
Related
Published
2022-10-02T00:00:00Z
Modified
2026-08-12T13:33:29Z
Summary
[none]
Details

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/42xxx/CVE-2022-42004.json"
}
References

Affected packages

Git / github.com/fasterxml/jackson-databind

Affected ranges

Type
GIT
Repo
https://github.com/fasterxml/jackson-databind
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea6f3d4b05dde564a1a5013dd34467d676072afa
Introduced
70c5dfbd52410d99d36181072711125ac5240a15
Fixed
13cd41d616022f63a0af38db2389de52199cf62c
Fixed
063183589218fec19a9293ed2f17ec53ea80ba88
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.12.7.1"
        },
        {
            "introduced":  "2.13.0"
        },
        {
            "fixed":  "2.13.4"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}
Type
GIT
Repo
https://github.com/quarkusio/quarkus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e37be4694aaef028733802065212f954dc4d408d
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.13.0"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

2.*
2.2.0c
2.6.0-rc3b
jackson-databind-2.*
jackson-databind-2.0.0
jackson-databind-2.0.0-RC1
jackson-databind-2.0.0-RC2
jackson-databind-2.0.0-RC3
jackson-databind-2.0.1
jackson-databind-2.0.2
jackson-databind-2.1.0
jackson-databind-2.1.1
jackson-databind-2.10.0
jackson-databind-2.10.0.pr1
jackson-databind-2.10.0.pr2
jackson-databind-2.10.0.pr3
jackson-databind-2.11.0
jackson-databind-2.11.0.rc1
jackson-databind-2.12.0
jackson-databind-2.12.0-rc1
jackson-databind-2.12.0-rc2
jackson-databind-2.12.1
jackson-databind-2.12.2
jackson-databind-2.12.3
jackson-databind-2.12.4
jackson-databind-2.12.5
jackson-databind-2.12.6
jackson-databind-2.12.6.1
jackson-databind-2.12.7
jackson-databind-2.13.0
jackson-databind-2.13.1
jackson-databind-2.13.2
jackson-databind-2.13.2.1
jackson-databind-2.13.2.2
jackson-databind-2.13.3
jackson-databind-2.2.0
jackson-databind-2.2.1
jackson-databind-2.2.2
jackson-databind-2.3.0
jackson-databind-2.3.0-rc1
jackson-databind-2.3.1
jackson-databind-2.4.0
jackson-databind-2.4.0-rc1
jackson-databind-2.4.0-rc2
jackson-databind-2.4.0-rc3
jackson-databind-2.4.1
jackson-databind-2.4.1.1
jackson-databind-2.4.1.2
jackson-databind-2.4.1.3
jackson-databind-2.5.0
jackson-databind-2.5.0-rc1
jackson-databind-2.6.0
jackson-databind-2.6.0-rc1
jackson-databind-2.6.0-rc4
jackson-databind-2.6.1
jackson-databind-2.7.0
jackson-databind-2.7.0-rc1
jackson-databind-2.7.0-rc2
jackson-databind-2.7.0-rc3
jackson-databind-2.7.1
jackson-databind-2.7.1-1
jackson-databind-2.8.0
jackson-databind-2.8.1
jackson-databind-2.8.2
jackson-databind-2.9.0
jackson-databind-2.9.0.pr1
jackson-databind-2.9.0.pr2
jackson-databind-2.9.0.pr3
jackson-databind-2.9.0.pr4
jackson-databind-2.9.1
jackson-databind-2.9.3
jackson-databind-2.9.4
jackson-databind-2.9.5
jackson-databind-2.9.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42004.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "41769431809239043105801363456361677444",
            "length":  185
        },
        "id":  "CVE-2022-42004-177dace2",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/fasterxml/jackson-databind/commit/063183589218fec19a9293ed2f17ec53ea80ba88",
        "target":  {
            "file":  "src/test/java/com/fasterxml/jackson/databind/deser/dos/DeepArrayWrappingForDeser3582Test.java",
            "function":  "testArrayWrapping"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "196164083740776567542182345255946541246",
                "10894080426655518553889929861642900518",
                "285497585603973688824816331635642080195",
                "262177914682987543292938895227102793127",
                "298595790872575652501042383929196324002",
                "241994611638143361585567038240044388292",
                "117393818864618325195207991637520669061",
                "116477719100725734768123961861805342497"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-42004-b1166048",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/fasterxml/jackson-databind/commit/063183589218fec19a9293ed2f17ec53ea80ba88",
        "target":  {
            "file":  "src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializer.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "187973000674063989520344797230644815276",
            "length":  1020
        },
        "id":  "CVE-2022-42004-c3275b0f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/fasterxml/jackson-databind/commit/063183589218fec19a9293ed2f17ec53ea80ba88",
        "target":  {
            "file":  "src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializer.java",
            "function":  "_deserializeFromArray"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "245221408806661661172976987552565576740",
                "115491996422398475562653924543632969622",
                "197858643989875646646709426998135342701",
                "114682010537655789279734069001341491122",
                "243574317414497553732521057942017015043",
                "210943436520935603188072514743451616414",
                "147521676498244637025003553143775234557",
                "96474537145626447436069197675871989278",
                "204985837386903992552570727398208016156",
                "113606183479390725392659529307859487808"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-42004-e3af9805",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/fasterxml/jackson-databind/commit/063183589218fec19a9293ed2f17ec53ea80ba88",
        "target":  {
            "file":  "src/test/java/com/fasterxml/jackson/databind/deser/dos/DeepArrayWrappingForDeser3582Test.java"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T13:33:29Z"