Skip to content
This repository was archived by the owner on Mar 2, 2026. It is now read-only.

fix: override jackson-bom version to patch DOS vulnerability (GHSA-72hv-8253-57qq)#3

Open
cwebberOps wants to merge 1 commit into
masterfrom
fix/jackson-core-dos-vuln-GHSA-72hv-8253-57qq
Open

fix: override jackson-bom version to patch DOS vulnerability (GHSA-72hv-8253-57qq)#3
cwebberOps wants to merge 1 commit into
masterfrom
fix/jackson-core-dos-vuln-GHSA-72hv-8253-57qq

Conversation

@cwebberOps

Copy link
Copy Markdown

Summary

  • Override jackson-bom version to fix high-severity DOS vulnerability in jackson-core async JSON parser
  • CVE: GHSA-72hv-8253-57qq
  • The async JSON parser fails to enforce maxNumberLength, allowing OOM/CPU exhaustion via crafted JSON payloads

Changes

  • Updated Jackson version properties to pull in patched Jackson version

Test plan

  • CI pipeline builds successfully with new Jackson version
  • Verify with mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-core that patched version is resolved

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant