CVE-2021-46877
jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode
Loading…
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · March 19, 2023
Updated · November 4, 2026
Description
A flaw was found in Jackson Databind. This issue may allow a malicious user to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400 · Uncontrolled Resource Consumption