Skip to content

[Aikido] Fix 5 security issues in jackson-core, jackson-databind, commons-io - #14

Open
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-81256073-wl4y
Open

[Aikido] Fix 5 security issues in jackson-core, jackson-databind, commons-io#14
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-81256073-wl4y

Conversation

@aikido-autofix

@aikido-autofix aikido-autofix Bot commented Aug 4, 2026

Copy link
Copy Markdown

Targeted updates to remediate security findings while preserving existing behavior

Upgrade jackson-core, jackson-databind, and commons-io to fix critical DoS vulnerabilities including stack overflow from deeply nested data, memory exhaustion from unbounded number parsing in async parsers, and CPU exhaustion in XML stream processing.

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2025-52999
HIGH
[jackson-core] A deeply nested input document can cause a StackOverflowError due to unbounded recursion depth during parsing. This vulnerability allows denial of service attacks, mitigated by introducing a configurable depth limit that defaults to 1000 levels.
GHSA-r7wm-3cxj-wff9
HIGH
[jackson-core] Incomplete fix for number length validation in the async JSON parser allows attackers to bypass maxNumberLength constraints by streaming chunks without terminators, causing unbounded memory accumulation up to maxStringLength (~20MB default) instead of the configured limit (~1KB default). This enables denial-of-service attacks against reactive frameworks through memory exhaustion.
CVE-2022-42003
HIGH
[jackson-databind] In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
CVE-2022-42004
HIGH
[jackson-databind] In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
CVE-2024-47554
LOW
[commons-io] XmlStreamReader may excessively consume CPU resources when processing maliciously crafted input, leading to a denial of service condition. An attacker can exploit this vulnerability to cause resource exhaustion and application unavailability.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Kroo Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants