Skip to content
Fencer Vulns
medium 4.0

CVE-2025-49128 json

Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation

published 2025-06-06 17 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-17366 , GHSA-wf8f-6423-gfxg

cvss
4.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's `JsonLocation._appendSourceDesc` method allows up to 500 bytes of unintended memory content to be included in exception messages. When parsing JSON from a byte array with an offset and length, the exception message incorrectly reads from the beginning of the array instead of the logical payload start. This results in possible information disclosure in systems using pooled or reused buffers, like Netty or Vert.x. This issue was silently fixed in jackson-core version 2.13.0, released on September 30, 2021, via PR #652. All users should upgrade to version 2.13.0 or later. If upgrading is not immediately possible, applications can mitigate the issue by disabling exception message exposure to clients to avoid returning parsing exception messages in HTTP responses and/or disabling source inclusion in exceptions to prevent Jackson from embedding any source content in exception messages, avoiding leakage.

Patch / fix

  • maven com.fasterxml.jackson.core:jackson-core 2.13.0
  • com.fasterxml.jackson.core jackson-core 2.13.0
  • fasterxml jackson-core 2.13.0
  • jackson-core Debian 14, Debian 13, Debian 12 2.13.0-1

debian advisories DEBIAN-CVE-2025-49128

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-49128 updated cvss 4.0

com.fasterxml.jackson.core/jackson-core: Jackson-core Memory Disclosure via Source Snippet in JsonLocation

  • Red Hat Cryostat 4 jackson-core Red Hat Logging Subsystem for Red Hat OpenShift jackson-core Red Hat OpenShift Developer Tools and Services jenkins, jenkins-2-plugins Red Hat OpenShift Serverless openshift-serverless-1/kn-ekb-receiver-rhel8, openshift-serverless-1/kn-ekb-dispatcher-rhel8, openshift-serverless-1/kn-ekb-post-install-rhel8, openshift-serverless-1/kn-ekb-webhook-kafka-rhel8, openshift-serverless-1/kn-ekb-kafka-controller-rhel8, openshift-serverless-1/kn-eventing-istio-controller-rhel8 Red Hat Ansible Automation Platform 2 jackson-core, python-drools-jpy-jar, python3x-drools-jpy-jar, python3.11-drools-jpy-jar Red Hat build of Apache Camel - HawtIO 4 jackson-core
    +26 more products
    Red Hat build of Apache Camel 4 for Quarkus 3 quarkus-cxf-bom, quarkus-camel-bom Red Hat build of Apache Camel for Spring Boot 4 jackson-core Red Hat build of Apicurio Registry 2 jackson-core Red Hat build of Apicurio Registry 3 jackson-core Red Hat build of Debezium 2 jackson-core Red Hat build of Debezium 3 jackson-core Red Hat build of OptaPlanner 8 jackson-core Red Hat build of Quarkus quarkus-bom Red Hat Ceph Storage 6 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more Red Hat Ceph Storage 7 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more Red Hat Ceph Storage 8 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +17 more Red Hat Data Grid 8 jackson-core Red Hat Enterprise Linux 8 log4j, modello, resteasy, log4j-jcl, log4j-web, jackson-bom, +12 more Red Hat Enterprise Linux 9 log4j, resteasy, log4j-jcl, log4j-slf4j, jackson-databind, pki-resteasy-core, +9 more Red Hat Fuse 7 jackson-core Red Hat Integration Camel K 1 jackson-core Red Hat JBoss Enterprise Application Platform 7 jackson-core Red Hat JBoss Enterprise Application Platform 8 jackson-core Red Hat JBoss Enterprise Application Platform Expansion Pack jackson-core Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel8, rhoai/odh-trustyai-service-rhel8 Red Hat OpenShift Dev Spaces devspaces/server-rhel8, devspaces/server-rhel9 Red Hat Process Automation 7 jackson-core Red Hat Satellite 6 puppetserver Red Hat Single Sign-On 7 jackson-core Red Hat streams for Apache Kafka jackson-core
    affected: workaround, no fix available “Fix deferred”
  • Red Hat A-MQ Clients 2 jackson-core Red Hat AMQ Broker 7 jackson-core Red Hat AMQ Clients jackson-core Red Hat streams for Apache Kafka 2 jackson-core
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/FasterXML/jackson-core/security/advisories/GHSA-wf8f-6423-gfxg referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub 3.1 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven com.fasterxml.jackson.core:jackson-core
>=2.0.0, <2.13.0
2.13.0

Affected products

  • FasterXML jackson-core

Classification

Weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.