CVE-2023-35116

False Positive in maven/com.fasterxml.jackson.core/jackson-databind

Identifiers

CVE-2023-35116

Package Slug

maven/com.fasterxml.jackson.core/jackson-databind

Vulnerability

False Positive

Description

jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.

Affected Versions

All versions before 2.16.0

Solution

Upgrade to version 2.16.0 or above.

Last Modified

2023-11-08

source