REDHAT-BUG-2445135: High severity Jackson jackson-core vulnerability
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jackson-coreto a version that resolves this vulnerability.Fixed in 3.1.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2445135?
The severity of REDHAT-BUG-2445135 is rated as high with a score of 7.
How do I fix REDHAT-BUG-2445135?
To fix REDHAT-BUG-2445135, update the Jackson core library to version 3.1.0 or later.
What software is affected by REDHAT-BUG-2445135?
The affected software for REDHAT-BUG-2445135 is Jackson jackson-core from versions 3.0.0 to before 3.1.0.
What does REDHAT-BUG-2445135 describe?
REDHAT-BUG-2445135 describes a vulnerability in the UTF8DataInputJsonParser that can bypass the maxNestingDepth constraint.
When was REDHAT-BUG-2445135 published?
REDHAT-BUG-2445135 was published on March 6, 2026.