Loading vulnerability…
Jackson Databind JsonNode JDK Serialization Denial of Service
CVE-2021-46877 is an uncontrolled resource-consumption vulnerability in FasterXML jackson-databind. In uncommon scenarios involving JDK serialization of JsonNode objects, processing a crafted read can cause approximately 2 GB of transient heap allocation per read. Affected versions are jackson-databind 2.10.x through 2.12.x before 2.12.6, and 2.13.x before 2.13.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to trigger the affected JsonNode JDK-serialization processing path can exhaust JVM heap resources, causing denial of service through memory pressure, allocation failures, or process termination.
If you can’t patch tonight, do this now.
Avoid using JDK serialization for JsonNode objects until a fixed jackson-databind version is deployed. Where the affected path must remain enabled, restrict untrusted input from reaching it and enforce JVM heap and request-resource limits to reduce denial-of-service exposure.
Patch, then assume compromise.
Upgrade jackson-databind to 2.12.6 or later for the 2.12.x release line, or 2.13.1 or later for the 2.13.x release line. Apply vendor-provided updates for products that bundle a vulnerable jackson-databind version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.