WaratekVRT Sign in

CVE-2022-42003 FasterXML jackson-databind

Affected softwareFasterXML jackson-databind
Severity7.5 High CVSS 3.1 2 scores
Fixed in2.12.7.1, 2.13.4.2
WeaknessDeserialization of untrusted data (CWE-502)
Published2 Oct 2022
Updated7 Oct 2026

Description

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

CWE-400 · Uncontrolled resource consumption

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 4 years ago.

  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 3.4% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

A public code fix exists: FasterXML/jackson-databind d78d00e.

  • Protection none
  • Action unverified
  • Review automated Upstream data
  • Record active
Decided by Exploit code for this candidate, published in a reviewed catalogue or a GitHub repository with 5 or more stars, or in use per CISA or VulnCheck; not only a CISA verdict, a forecast, or nothing at all
Finding This CVE is not listed in CISA KEV or VulnCheck KEV, CISA Vulnrichment records no active exploitation, no reviewed exploit catalogue carries an entry for it, and no GitHub PoC repository for it has 5 or more stars. Nobody has published exploit code worth tracing, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious.
Candidate fix https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 : a commit: the change itself

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CISA-ADP Secondary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2025 ↗ CPU 2025-Q2 Oracle Fusion Middleware / Runtime Server (jackson-databind) (12.2.1.4.0)
Oracle Critical Patch Update July 2024 ↗ CPU 2024-Q3 Oracle Siebel CRM / Installation (jackson-databind) (24.4 and prior)
Oracle Critical Patch Update April 2024 ↗ CPU 2024-Q2 Oracle Commerce / Platform (jackson-databind) (11.3.0, 11.3.1, 11.3.2)
Oracle Fusion Middleware / Third Party (jackson-databind) (12.2.1.3.0)
Oracle Systems / Tools (jackson-databind) (4)
Oracle Critical Patch Update January 2024 ↗ CPU 2024-Q1 Oracle Enterprise Manager / Agent Next Gen (jackson-databind) (13.5.0.0)
Oracle Enterprise Manager / Extensibility Framework (jackson-databind) (13.5.0.0)
Oracle Enterprise Manager / Plug-In Lifecycle (jackson-databind) (13.5.0.0)
Oracle Financial Services Applications / Base (jackson-databind) (14.5.0-14.7.0)
Oracle Financial Services Applications / Common Core (jackson-databind) (14.5.0-14.7.0)
Oracle Financial Services Applications / Infrastructure (jackson-databind) (14.5.0-14.7.0)
Oracle Financial Services Applications / Infrastructure Code (jackson-databind) (14.5.0-14.7.0)
Oracle Critical Patch Update October 2023 ↗ CPU 2023-Q4 Oracle Financial Services Applications / UI (jackson-databind) (2.7, 2.12)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Analytics / Visual Analyzer (jackson-databind) (6.4.0.0.0, 7.0.0.0.0)
Oracle Enterprise Manager / Load Testing for Web Apps (jackson-databind) (13.3.0.1)
Oracle Financial Services Applications / Accessibility (jackson-databind) (14.7.0.2.0, 14.7.1.0.0)
Oracle Financial Services Applications / Common (jackson-databind) (14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0)
Oracle Financial Services Applications / Common (jackson-databind) (14.7.1.0.0)
Oracle Financial Services Applications / Dashboard (jackson-databind) (14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0)
Oracle Financial Services Applications / INFRA code (jackson-databind) (14.0-14.7)
Oracle Financial Services Applications / Infra Code (jackson-databind) (14.5-14.7)
Oracle Financial Services Applications / Infrastructure (jackson-databind) (14.0-14.3, 14.5-14.7)
Oracle Financial Services Applications / Security (jackson-databind) (14.7.0.2.0, 14.7.1.0.0)
Oracle Financial Services Applications / core module (jackson-databind) (14.0-14.3, 14.5-14.7)
Oracle GoldenGate / Oracle GoldenGate Stream Analytics (jackson-databind) (19.1.0.0.0-19.1.0.0.7)
Oracle Siebel CRM / Siebel Core (Apache ZooKeeper) (23.5 and prior)
Oracle Supply Chain / Core (jackson-databind) (21.0.2)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Analytics / Analytics Server (jackson-databind) (6.4.0.0.0)
Oracle Commerce / Content Acquisition System, Workbench (jackson-databind) (11.3.2)
Oracle Communications / BEServer (jackson-databind) (9.0.0, 9.0.1)
Oracle Communications / BEServer (jackson-databind) (9.0.0, 9.0.1)
Oracle Communications / Core (jackson-databind) (12.6.0.0.0)
Oracle Communications / Install/Upgrade (jackson-databind) (22.3.0)
Oracle Communications / Internal tools (jackson-databind) (9.1.1.4.0)
Oracle Financial Services Applications / Application (jackson-databind) (8.0.8.1, 8.1.1.1, 8.1.2.3, 8.1.2.4)
Oracle Financial Services Applications / Application (jackson-databind) (8.1.2.4, 8.1.2.3, 8.1.1.1, 8.0.8.2)
Oracle Financial Services Applications / Infrastructure (jackson-databind) (8.0.7.0, 8.0.8.0, 8.0.9.0, 8.1.0.0, 8.1.1.0, 8.1.2.0, 8.1.2.1, 8.1.2.2)
Oracle Financial Services Applications / UI General (jackson-databind) (18.2, 18.3, 19.1, 19.2, 21.1, 22.1, 22.2)
Oracle Fusion Middleware / Core (jackson-databind) (12.2.1.4.0, 14.1.1.0.0)
Oracle Fusion Middleware / Installer (jackson-databind) (12.2.1.4.0)
Oracle Fusion Middleware / Installer (jackson-databind) (12.2.1.4.0)
Oracle Fusion Middleware / Security Framework (jackson-databind) (12.2.1.4.0)
Oracle GoldenGate / Oracle GoldenGate (jackson-databind) (Prior to 19.1.0.0.230418, Prior to 21.10.0.0.0)
Oracle Graph Server and Client / Packaging (jackson-databind) (Prior to 23.1.0)
Oracle HealthCare Applications / User Interface (jackson-databind) (4.1.0, 4.1.1)
Oracle Insurance Applications / Development Tools (jackson-databind) (12.6.0.0.0, 12.6.2.0.0-12.6.4.0.0, 12.7.0.0.0, 12.7.1.0.0)
Oracle JD Edwards / Web Runtime SEC (jackson-databind) (Prior to 9.2.7.3)
Oracle NoSQL Database / Administration (jackson-databind) (Prior to 19.5.32)
Oracle Retail Applications / Foundation (jackson-databind) (15.0.3.1)
Oracle Retail Applications / Internal Operations (jackson-databind) (18.0.0.12, 19.0.0.6)
Oracle Retail Applications / Xenvironment (jackson-databind) (17.0.6, 18.0.5, 19.0.4, 20.0.3, 21.0.2)
Oracle Retail Applications / others (jackson-databind) (15.0.3.1)
Oracle SQL Developer / Infrastructure (jackson-databind) (Prior to 23.1.0)
Oracle Siebel CRM / EAI (jackson-databind) (23.2 and prior)
Oracle Supply Chain / Security (jackson-databind) (9.3.6)
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle Communications / Configuration (jackson-databind) (22.3.0)
Oracle Communications / Configuration (jackson-databind) (22.3.1)
Oracle Communications / Installation (jackson-databind) (22.3.2)
Oracle Communications / Mediation (jackson-databind) (8.2.3.0)
Oracle Communications / Platform (jackson-databind) (22.3.1)
Oracle Communications / Platform (jackson-databind) (22.3.1)
Oracle Communications / REST API (jackson-databind) (22.0.0.0.0)
Oracle Communications / Security (jackson-databind) (22.1.0.0.0)
Oracle Communications / Signaling (jackson-databind) (22.2.2, 22.3.3)
Oracle Communications Applications / Billing Care, BOC, DM Kafka, REST API (jackson-databind) (12.0.0.4.0-12.0.0.7.0)
Oracle Communications Applications / Calendar Server (jackson-databind) (8.0.0.6.0)
Oracle Communications Applications / Contact Server (jackson-databind) (8.0.0.7.0)
Oracle Communications Applications / DBPlugin (jackson-databind) (10.0.1.6.0)
Oracle Communications Applications / ISC (jackson-databind) (8.1.0.20.0)
Oracle Communications Applications / Message Bus (jackson-databind) (5.5.0-5.5.9, 6.0.0-6.0.1)
Oracle Communications Applications / Others (jackson-databind) (7.4.0, 7.4.1, 7.4.2, 7.5.0)
Oracle Communications Applications / REST Service Manager (jackson-databind) (12.0.0.5.0-12.0.0.7.0)
Oracle Construction and Engineering / Admin (jackson-databind) (18.8.0-18.8.15, 19.12.0-19.12.15, 20.12.0-20.12.10, 21.12.0-21.12.8)
Oracle Construction and Engineering / Document Management (jackson-databind) (18.8, 19.12, 20.12, 21.12, 22.12)
Oracle Database Server / Oracle Database - Workload Manager (jackson-databind) (19c, 21c)
Oracle Database Server / Oracle Database Fleet Patching (jackson-databind) (19c, 21c)
Oracle Financial Services Applications / Collections (jackson-databind) (2.7.1, 2.12.0)
Oracle Financial Services Applications / Security (jackson-databind) (2.6.2, 2.7.1, 2.9.0, 2.12.0)
Oracle Financial Services Applications / Studio (jackson-databind) (8.0.8.3.1)
Oracle Financial Services Applications / Web UI (jackson-databind) (2.7.0)
Oracle Financial Services Applications / Web UI (jackson-databind) (2.8.0, 2.12.0)
Oracle Fusion Middleware / NextGen Installer issues (jackson-databind) (Prior to 13.9.4.2.11)
Oracle Health Sciences Applications / Core (jackson-databind) (9.1.0.52, 9.2.0.52)
Oracle PeopleSoft / Elastic Search (jackson-databind) (8.59, 8.60)
Oracle Retail Applications / Installation (jackson-databind) (14.1.3.2, 15.0.3.1, 16.0.3)
Oracle Utilities Applications / General (jackson-databind) (4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Analytics Analytics Server (jackson-databind) 6.4.0.0.0 6.4.0.0.0
Oracle Analytics Visual Analyzer (jackson-databind) 6.4.0.0.0, 7.0.0.0.0 6.4.0.0.0 · 7.0.0.0.0
Oracle Commerce Content Acquisition System, Workbench (jackson-databind) 11.3.2 11.3.2
Oracle Commerce Platform (jackson-databind) 11.3.0, 11.3.1, 11.3.2 11.3.0 · 11.3.1 · 11.3.2
Oracle Communications BEServer (jackson-databind) 9.0.0, 9.0.1 9.0.0 · 9.0.1
Oracle Communications Configuration (jackson-databind) 22.3.0 22.3.0 · 22.3.1
Oracle Communications Core (jackson-databind) 12.6.0.0.0 12.6.0.0.0
Oracle Communications Install/Upgrade (jackson-databind) 22.3.0 22.3.0
Oracle Communications Installation (jackson-databind) 22.3.2 22.3.2
Oracle Communications Internal tools (jackson-databind) 9.1.1.4.0 9.1.1.4.0
Oracle Communications Mediation (jackson-databind) 8.2.3.0 8.2.3.0
Oracle Communications Platform (jackson-databind) 22.3.1 22.3.1
Oracle Communications REST API (jackson-databind) 22.0.0.0.0 22.0.0.0.0
Oracle Communications Security (jackson-databind) 22.1.0.0.0 22.1.0.0.0
Oracle Communications Signaling (jackson-databind) 22.2.2, 22.3.3 22.2.2 · 22.3.3
Oracle Communications Applications Billing Care, BOC, DM Kafka, REST API (jackson-databind) 12.0.0.4.0-12.0.0.7.0
Oracle Communications Applications Calendar Server (jackson-databind) 8.0.0.6.0 8.0.0.6.0
Oracle Communications Applications Contact Server (jackson-databind) 8.0.0.7.0 8.0.0.7.0
Oracle Communications Applications DBPlugin (jackson-databind) 10.0.1.6.0 10.0.1.6.0
Oracle Communications Applications ISC (jackson-databind) 8.1.0.20.0 8.1.0.20.0
Oracle Communications Applications Message Bus (jackson-databind) 5.5.0-5.5.9, 6.0.0-6.0.1
Oracle Communications Applications Others (jackson-databind) 7.4.0, 7.4.1, 7.4.2, 7.5.0 7.4.0 · 7.4.1 · 7.4.2 · 7.5.0
Oracle Communications Applications REST Service Manager (jackson-databind) 12.0.0.5.0-12.0.0.7.0
Oracle Construction and Engineering Admin (jackson-databind) 18.8.0-18.8.15, 19.12.0-19.12.15, 20.12.0-20.12.10, 21.12.0-21.12.8
Oracle Construction and Engineering Document Management (jackson-databind) 18.8, 19.12, 20.12, 21.12, 22.12 18.8 · 19.12 · 20.12 · 21.12 · 22.12
Oracle Database Server Oracle Database - Workload Manager (jackson-databind) 19c, 21c 19 · 21
Oracle Database Server Oracle Database Fleet Patching (jackson-databind) 19c, 21c 19 · 21
Oracle Enterprise Manager Agent Next Gen (jackson-databind) 13.5.0.0 13.5.0.0
Oracle Enterprise Manager Extensibility Framework (jackson-databind) 13.5.0.0 13.5.0.0
Oracle Enterprise Manager Load Testing for Web Apps (jackson-databind) 13.3.0.1 13.3.0.1
Oracle Enterprise Manager Plug-In Lifecycle (jackson-databind) 13.5.0.0 13.5.0.0
Oracle Financial Services Applications Accessibility (jackson-databind) 14.7.0.2.0, 14.7.1.0.0 14.7.0.2.0 · 14.7.1.0.0
Oracle Financial Services Applications Application (jackson-databind) 8.0.8.1, 8.1.1.1, 8.1.2.3, 8.1.2.4 8.0.8.1 · 8.0.8.2 · 8.1.1.1 · 8.1.2.3 · 8.1.2.4
Oracle Financial Services Applications Base (jackson-databind) 14.5.0-14.7.0
Oracle Financial Services Applications Collections (jackson-databind) 2.7.1, 2.12.0 2.7.1 · 2.12.0
Oracle Financial Services Applications Common (jackson-databind) 14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0 14.5.0.8.0 · 14.6.0.4.0 · 14.7.0.2.0 · 14.7.1.0.0
Oracle Financial Services Applications Common Core (jackson-databind) 14.5.0-14.7.0
Oracle Financial Services Applications Dashboard (jackson-databind) 14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0 14.5.0.8.0 · 14.6.0.4.0 · 14.7.0.2.0 · 14.7.1.0.0
Oracle Financial Services Applications INFRA code (jackson-databind) 14.0-14.7
Oracle Financial Services Applications Infra Code (jackson-databind) 14.5-14.7
Oracle Financial Services Applications Infrastructure (jackson-databind) 14.0-14.3, 14.5-14.7 8.0.7.0 · 8.0.8.0 · 8.0.9.0 · 8.1.0.0 · 8.1.1.0 · 8.1.2.0 · 8.1.2.1 · 8.1.2.2
Oracle Financial Services Applications Infrastructure Code (jackson-databind) 14.5.0-14.7.0
Oracle Financial Services Applications Security (jackson-databind) 2.6.2, 2.7.1, 2.9.0, 2.12.0 2.6.2 · 2.7.1 · 2.9.0 · 2.12.0 · 14.7.0.2.0 · 14.7.1.0.0
Oracle Financial Services Applications Studio (jackson-databind) 8.0.8.3.1 8.0.8.3.1
Oracle Financial Services Applications UI (jackson-databind) 2.7, 2.12 2.7 · 2.12
Oracle Financial Services Applications UI General (jackson-databind) 18.2, 18.3, 19.1, 19.2, 21.1, 22.1, 22.2 18.2 · 18.3 · 19.1 · 19.2 · 21.1 · 22.1 · 22.2
Oracle Financial Services Applications Web UI (jackson-databind) 2.7.0 2.7.0 · 2.8.0 · 2.12.0
Oracle Financial Services Applications core module (jackson-databind) 14.0-14.3, 14.5-14.7
Oracle Fusion Middleware Core (jackson-databind) 12.2.1.4.0, 14.1.1.0.0 12.2.1.4.0 · 14.1.1.0.0
Oracle Fusion Middleware Installer (jackson-databind) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware NextGen Installer issues (jackson-databind) Prior to 13.9.4.2.11
Oracle Fusion Middleware Runtime Server (jackson-databind) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Security Framework (jackson-databind) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Third Party (jackson-databind) 12.2.1.3.0 12.2.1.3.0
Oracle GoldenGate Oracle GoldenGate (jackson-databind) Prior to 19.1.0.0.230418, Prior to 21.10.0.0.0
Oracle GoldenGate Oracle GoldenGate Stream Analytics (jackson-databind) 19.1.0.0.0-19.1.0.0.7
Oracle Graph Server and Client Packaging (jackson-databind) Prior to 23.1.0
Oracle Health Sciences Applications Core (jackson-databind) 9.1.0.52, 9.2.0.52 9.1.0.52 · 9.2.0.52
Oracle HealthCare Applications User Interface (jackson-databind) 4.1.0, 4.1.1 4.1.0 · 4.1.1
Oracle Insurance Applications Development Tools (jackson-databind) 12.6.0.0.0, 12.6.2.0.0-12.6.4.0.0, 12.7.0.0.0, 12.7.1.0.0 12.6.0.0.0 · 12.7.0.0.0 · 12.7.1.0.0
Oracle JD Edwards Web Runtime SEC (jackson-databind) Prior to 9.2.7.3
Oracle NoSQL Database Administration (jackson-databind) Prior to 19.5.32
Oracle PeopleSoft Elastic Search (jackson-databind) 8.59, 8.60 8.59 · 8.60
Oracle Retail Applications Foundation (jackson-databind) 15.0.3.1 15.0.3.1
Oracle Retail Applications Installation (jackson-databind) 14.1.3.2, 15.0.3.1, 16.0.3 14.1.3.2 · 15.0.3.1 · 16.0.3
Oracle Retail Applications Internal Operations (jackson-databind) 18.0.0.12, 19.0.0.6 18.0.0.12 · 19.0.0.6
Oracle Retail Applications Xenvironment (jackson-databind) 17.0.6, 18.0.5, 19.0.4, 20.0.3, 21.0.2 17.0.6 · 18.0.5 · 19.0.4 · 20.0.3 · 21.0.2
Oracle Retail Applications others (jackson-databind) 15.0.3.1 15.0.3.1
Oracle SQL Developer Infrastructure (jackson-databind) Prior to 23.1.0
Oracle Siebel CRM EAI (jackson-databind) 23.2 and prior
Oracle Siebel CRM Installation (jackson-databind) 24.4 and prior
Oracle Siebel CRM Siebel Core (Apache ZooKeeper) 23.5 and prior
Oracle Supply Chain Core (jackson-databind) 21.0.2 21.0.2
Oracle Supply Chain Security (jackson-databind) 9.3.6 9.3.6
Oracle Systems Tools (jackson-databind) 4 4
Oracle Utilities Applications General (jackson-databind) 4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0 4.3.0.5.0 · 4.3.0.6.0 · 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 · 4.5.0.0.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
com.fasterxml.jackson.core:jackson-databind 2.4.0-rc1 2.12.7.1 unbounded
com.fasterxml.jackson.core:jackson-databind 2.13.0 2.13.4.2 unbounded

Products and versions

5 products, 8 version entries
SourceVendorProductSchemeAffected versions
osv com.fasterxml.jackson.core jackson-databind generic ≥ 2.4.0 and < 2.12.7.1 · ≥ 2.13.0 and < 2.13.4.2
nvd debian debian linux generic 10.0 · 11.0
nvd fasterxml jackson-databind generic < 2.12.7.1 · ≥ 2.13.0 and < 2.13.4.1
nvd netapp oncommand workflow automation generic any version
nvd quarkus quarkus generic < 2.13.3

References

URLTags
https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 commit
https://github.com/FasterXML/jackson-databind/issues/3590 WEB
https://github.com/FasterXML/jackson-databind/issues/3627 WEB
https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1 WEB
https://github.com/FasterXML/jackson-databind/commit/2c4a601c626f7790cad9d3c322d244e182838288 WEB
https://github.com/FasterXML/jackson-databind/commit/7ba9ac5b87a9d6ac0d2815158ecbeb315ad4dcdc WEB
https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea WEB
https://github.com/FasterXML/jackson-databind/commit/d499f2e7bbc5ebd63af11e1f5cf1989fa323aa45 WEB
https://www.debian.org/security/2022/dsa-5283 WEB
https://security.netapp.com/advisory/ntap-20221124-0004 WEB

Timeline

Published2022-10-02By the CVE Program.
NVD record modified2026-10-07NVD's own last-modified date for this record.