CVE-2023-35116

CVE-2023-35116

maven/com.fasterxml.jackson.core/jackson-databind

Allocation of Resources Without Limits or Throttling

jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.

All versions up to 2.15.2

Upgrade to version 2.15.3 or above.

2023-11-08