CVE-2023-35116
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies.
Risk Assessment
The organization may be exposed to attacks leading to denial of service, although the vendor considers this not a valid vulnerability.
Recommendation
It is recommended to update jackson-databind to the latest version to minimize the risk associated with potential attacks.
Original NVD description (English source)
jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.