CVE-2022-42004

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization...

CVE-2022-42004: Deserialization of Untrusted Data

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization...

CVE-2022-42004

The CVE affects FasterXML jackson-databind prior to 2.13.4, where resource exhaustion can occur due to a missing check in BeanDeserializer._deserializeFromArray that prevents deeply nested arrays. An application is vulnerable only with certain customized deserialization paths. Concrete details ac...

jackson-databind:ObjectReader2Fuzzer: Security exception in com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeFromArray

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=4681021680910336 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ObjectReader2Fuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Security...