-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | maven | < 2.12.7.1 | 2.12.7.1 |
| com.fasterxml.jackson.core:jackson-databind | maven | >= 2.13.0, < 2.13.4 | 2.13.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from BeanDeserializer._deserializeFromArray's handling of array unwrapping. The commit diff shows a critical addition: a check for subsequent START_ARRAY tokens after initial array unwrapping. Prior to the patch, this function would recursively process nested arrays without depth validation when UNWRAP_SINGLE_VALUE_ARRAYS was enabled, leading to stack overflows or memory exhaustion. The test case modifications and CVE description explicitly reference this function as the attack vector. Other components like StdDeserializer were patched for similar issues in related CVEs (CVE-2022-42003), but this specific CVE-2022-42004 is tied to the BeanDeserializer implementation.
Ongoing coverage of React2Shell