CVE-2021-46877: fasterxml jackson-databind
Modified
AliasesUBUNTU-CVE-2021-46877DEBIAN-CVE-2021-46877CGA-2x5p-g524-f647CGA-64hg-fcv8-vgwjCGA-h742-48hx-f5pqCGA-hc79-fvrx-522jCGA-jm74-mcj2-2g3wCGA-m65j-pwc7-vwh7CGA-r7hg-5fm3-8pv8CGA-r8r8-mwhv-x9wrCGA-27q7-8p7p-35vcCGA-2fh3-w2w7-4qrxCGA-2p2v-wcgc-q83hCGA-2ph3-g5gv-xhmwCGA-2qxh-v67x-293cCGA-2vm3-2972-426mCGA-32p3-9jw4-q4cqCGA-34jh-6cpp-qvffCGA-352v-3wf8-p369CGA-38j2-8c5j-r85mCGA-3g76-6vxx-262xCGA-3j47-g666-m86vCGA-3qmw-99mc-mr8mCGA-3qph-h524-whm5CGA-3w35-qfmp-6wg5CGA-4982-7wfp-m8cjCGA-49jq-wf9r-f5phCGA-4g8j-m694-44qmCGA-4qpj-8hvc-v3qcCGA-4wrj-gvxw-x637CGA-52v4-p82v-gqxgCGA-53qq-m3q5-fv2jCGA-5468-pxfr-67hxCGA-56q3-86mq-gjmjCGA-5rp3-q4c4-gwmhCGA-6724-p8p9-g4p4CGA-67qq-6x6r-c6vcCGA-68vp-99j2-m974CGA-6r2m-v4gx-55w8CGA-6rqm-2w4q-9v7gCGA-73h3-4prp-vq58CGA-7fvp-fcm7-wx27CGA-7j43-57rx-3jrcCGA-7rh4-hw6c-4mwxCGA-7v8x-jhpm-8x5mCGA-83gh-4wpp-g8p3CGA-84qj-j7m7-2hp3CGA-85x6-wpjr-f3g8CGA-8m7f-w4wf-prqxCGA-8mj6-hxjp-vv88CGA-8v28-3mqx-x99rCGA-92fr-gv9h-6xprCGA-96c9-pw7q-rwhvCGA-9h82-w69r-f9v4CGA-c32w-7xm9-gp6xCGA-f9r4-2f6r-w2f2CGA-fcmq-pr36-42w8CGA-fqr8-hfv9-vc57CGA-g357-9qmh-6w8pCGA-gfw9-p6cx-f325CGA-hh48-7c54-284cCGA-hxmj-rcpf-w5pfCGA-j24m-x535-mm9rCGA-j293-jp9g-w74wCGA-jfm5-r43c-rf33CGA-jmxm-x96x-2q55CGA-m32f-w5fv-3rxrCGA-m3g5-xmrj-wf2fCGA-m95g-jcqm-qx25CGA-mh5m-p75g-m5c5CGA-mpg2-vr4h-7w4gCGA-p98h-wjm9-9g3vCGA-p994-4qr6-vhq5CGA-pfr5-87f2-c8p8CGA-pv7c-g3v7-8c6mGHSA-3x8x-79m2-3w2wCGA-qg42-8wpx-rhg2CGA-qvpr-jw93-m3h8CGA-qwgr-xj43-9qjwCGA-r46c-34gf-5fj6CGA-rfrh-hhfj-768jCGA-rhxv-fcc4-mgx5CGA-rv89-fgj9-gqxhCGA-v3p2-73pm-367fCGA-vwgq-9f76-x4mwCGA-w76q-366c-46m9CGA-wf83-fvx7-6379CGA-wrwp-h26j-jxx7CGA-wvcf-284f-jx52CGA-wwrw-gj35-grq5CGA-xq53-qwv6-wwx8
Published 18-03-2023Last modified 26-02-2025
Vulnerability summary
CVE-2021-46877 is a high (CVSS 7.5) vulnerability in fasterxml jackson-databind. EPSS estimates a 1.12% chance of exploitation in the next 30 days, higher than 66.2% of scored vulnerabilities. 1 public exploit is recorded.
Priority
Prioritisepublic exploit
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
1.12%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 9 · Related 4Timeline
- 18-03-2023PublishedVulnerability first disclosed.
- 26-02-2025Last modifiedVulnerability information updated.
Description
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.12%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.12% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundJackson Databind
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard41 products
- cassandra-reaper< 4.0.1-r1
- eco-java-gradle-6.3All versions (No fix recorded)
- eco-java-gradle-6.4All versions (No fix recorded)
- eco-java-gradle-6.4.1All versions (No fix recorded)
- eco-java-gradle-6.5All versions (No fix recorded)
Wolfi4 products
- cassandra-reaper< 4.0.1-r1
- management-api-for-apache-cassandra-5.0< 0.1.89-r0
- management-api-for-apache-cassandra-5.0-compat< 0.1.89-r0
- scala-3.8< 3.8.4-r1
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.10.0, < 2.12.6 | ≥ 2.13.0, < 2.13.1
Debian1 product
- jackson-databind< 2.13.2.2-1
Fasterxml1 product
- jackson-databind≥ 2.10.0, < 2.12.6 | 2.13.0 | 2.13.0:rc1 | 2.13.0:rc2
Ubuntu1 product
- jackson-databindAll versions (No fix recorded)
6 vendors · 49 products
