GitHub Advisoryadvisory · Maven

GHSA-rg2c-cfxv-qp6f Denial of service in jackson-dataformat-toml

HIGH Published 2023-08-08 Modified 2025-10-10 Official page ↗
Aliases
CVE-2023-3894
Ecosystem
Maven
Packages
com.fasterxml.jackson.dataformat:jackson-dataformat-toml
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-400, CWE-787
Reviewed
2023-08-09

Affected packages

• Maven com.fasterxml.jackson.dataformat:jackson-dataformat-toml: < 2.15.0 → fixed in 2.15.0

Description

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Related

Alias · CVE (1)

  • CVE-2023-3894 Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). vulnerability

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-787 Out-of-bounds Write weakness

References