CVE-2022-42003

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-42003
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42003.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-42003
Aliases
Downstream
CGA (244)
CLEANSTART (1)
CLSA (4)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (5)
OESA (2)
openSUSE (2)
RHSA (13)
RLSA (1)
ROOT (1)
SUSE (1)
UBUNTU (1)
Related
openSUSE (2)
SUSE (1)
Published
2022-10-02T00:00:00Z
Modified
2026-10-14T02:45:11Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/42xxx/CVE-2022-42003.json"
}
References

Affected packages

Git / github.com/fasterxml/jackson-databind

Affected ranges

Type
GIT
Repo
https://github.com/fasterxml/jackson-databind
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea6f3d4b05dde564a1a5013dd34467d676072afa
Introduced
70c5dfbd52410d99d36181072711125ac5240a15
Fixed
19e6b6fbcfd4105dc6365928ebc2f07da61e78c5
Fixed
d78d00ee7b5245b93103fef3187f70543d67ca33
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.12.7.1"
        },
        {
            "introduced":  "2.13.0"
        },
        {
            "fixed":  "2.13.4.1"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.2.0c
2.6.0-rc3b
jackson-databind-2.*
jackson-databind-2.0.0
jackson-databind-2.0.0-RC1
jackson-databind-2.0.0-RC2
jackson-databind-2.0.0-RC3
jackson-databind-2.0.1
jackson-databind-2.0.2
jackson-databind-2.1.0
jackson-databind-2.1.1
jackson-databind-2.10.0
jackson-databind-2.10.0.pr1
jackson-databind-2.10.0.pr2
jackson-databind-2.10.0.pr3
jackson-databind-2.11.0
jackson-databind-2.11.0.rc1
jackson-databind-2.12.0
jackson-databind-2.12.0-rc1
jackson-databind-2.12.0-rc2
jackson-databind-2.12.1
jackson-databind-2.12.2
jackson-databind-2.12.3
jackson-databind-2.12.4
jackson-databind-2.12.5
jackson-databind-2.12.6
jackson-databind-2.12.6.1
jackson-databind-2.12.7
jackson-databind-2.13.0
jackson-databind-2.13.1
jackson-databind-2.13.2
jackson-databind-2.13.2.1
jackson-databind-2.13.2.2
jackson-databind-2.13.3
jackson-databind-2.13.4
jackson-databind-2.2.0
jackson-databind-2.2.1
jackson-databind-2.2.2
jackson-databind-2.3.0
jackson-databind-2.3.0-rc1
jackson-databind-2.3.1
jackson-databind-2.4.0
jackson-databind-2.4.0-rc1
jackson-databind-2.4.0-rc2
jackson-databind-2.4.0-rc3
jackson-databind-2.4.1
jackson-databind-2.4.1.1
jackson-databind-2.4.1.2
jackson-databind-2.4.1.3
jackson-databind-2.5.0
jackson-databind-2.5.0-rc1
jackson-databind-2.6.0
jackson-databind-2.6.0-rc1
jackson-databind-2.6.0-rc4
jackson-databind-2.6.1
jackson-databind-2.7.0
jackson-databind-2.7.0-rc1
jackson-databind-2.7.0-rc2
jackson-databind-2.7.0-rc3
jackson-databind-2.7.1
jackson-databind-2.7.1-1
jackson-databind-2.8.0
jackson-databind-2.8.1
jackson-databind-2.8.2
jackson-databind-2.9.0
jackson-databind-2.9.0.pr1
jackson-databind-2.9.0.pr2
jackson-databind-2.9.0.pr3
jackson-databind-2.9.0.pr4
jackson-databind-2.9.1
jackson-databind-2.9.3
jackson-databind-2.9.4
jackson-databind-2.9.5
jackson-databind-2.9.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42003.json"

Git / github.com/quarkusio/quarkus

Affected ranges

Type
GIT
Repo
https://github.com/quarkusio/quarkus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8bd0e96a4f1d24691e4bf6a9987fcfab3757ae63
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.13.3"
        }
    ],
    "source":  "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42003.json"