CVE-2025-49128

A flaw was found in the Jackson-core JsonLocation._appendSourceDesc method. This vulnerability allows up to 500 bytes of unintended memory content to be included in exception messages. This issue may lead to unintended information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If upgrading is not immediately possible, applications can mitigate the issue by disabling exception message exposure to clients to avoid returning parsing exception messages in HTTP responses and/or disabling source inclusion in exceptions to prevent Jackson from embedding any source content in exception messages, avoiding leakage.