CVE-2021-46877 jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode
Attackers can cause denial of service via excessive heap usage in jackson-databind during JsonNode JDK serialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-46877?
CVE-2021-46877 is a high-severity denial of service vulnerability in Fasterxml Jackson-Databind, published on 18 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
Weakness: CWE-770
Which versions are affected by CVE-2021-46877?
4 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-databind Maven | From 2.10.0 | 2.12.6 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.10.0 | 2.12.6 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.13.0 | 2.13.1 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.13.0 | 2.13.1 |
Products include Fasterxml Jackson-Databind.
How do I fix CVE-2021-46877?
Upgrade com.fasterxml.jackson.core:jackson-databind to a fixed version for your release line: 2.12.6 or 2.13.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-46877 being exploited?
There is no known exploitation of CVE-2021-46877 in the wild and no public exploit code.
Other vulnerabilities in Fasterxml Jackson-Databind
- CVE-2018-11307 Deserialization of Untrusted Data in jackson-databind
- CVE-2026-54512 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
- CVE-2026-54513 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
- CVE-2020-14060 Deserialization of untrusted data in Jackson Databind
- CVE-2019-14893 Polymorphic deserialization of malicious object in jackson-databind
Sources
Also known as DEBIAN-CVE-2021-46877, GHSA-3x8x-79m2-3w2w, MINI-6p6p-mg4p-vvqr, ROOT-APP-MAVEN-CVE-2021-46877, UBUNTU-CVE-2021-46877.