Core Jackson processing abstractions (aka Streaming API), implementation for JSON
Language
JAVA
Vulnerability
Denial Of Service (DoS)
Vulnerability description
jackson-core is vulnerable to denial of service (DoS) attacks. The vulnerability is triggered when jackson-core reports an invalid token which has a word of length 10MB. It prints out the token to server.log file without limiting maxTokenLength to 256 bytes. This can cause a denial of service condition by filling up the disk space available.
Veracode Software Composition Analysis
server.log
file without limitingmaxTokenLength
to 256 bytes. This can cause a denial of service condition by filling up the disk space available.Links: