CVE-2021-46877

Aliases:GHSA-3x8x-79m2-3w2wDEBIAN-CVE-2021-46877CGA-2x5p-g524-f647CGA-64hg-fcv8-vgwjCGA-h742-48hx-f5pqCGA-hc79-fvrx-522jCGA-jm74-mcj2-2g3wCGA-m65j-pwc7-vwh7CGA-2fh3-w2w7-4qrxCGA-2p2v-wcgc-q83hCGA-34jh-6cpp-qvffCGA-4wrj-gvxw-x637CGA-5468-pxfr-67hxCGA-6724-p8p9-g4p4CGA-67qq-6x6r-c6vcCGA-7fvp-fcm7-wx27CGA-7rh4-hw6c-4mwxCGA-7v8x-jhpm-8x5mCGA-84qj-j7m7-2hp3CGA-85x6-wpjr-f3g8CGA-92fr-gv9h-6xprCGA-96c9-pw7q-rwhvCGA-c32w-7xm9-gp6xCGA-f9r4-2f6r-w2f2CGA-fcmq-pr36-42w8CGA-fqr8-hfv9-vc57CGA-m95g-jcqm-qx25CGA-mpg2-vr4h-7w4gCGA-p98h-wjm9-9g3vCGA-p994-4qr6-vhq5CGA-pfr5-87f2-c8p8CGA-qwgr-xj43-9qjwCGA-r46c-34gf-5fj6CGA-r7hg-5fm3-8pv8CGA-r8r8-mwhv-x9wrCGA-wf83-fvx7-6379CGA-wvcf-284f-jx52CGA-xq53-qwv6-wwx8CGA-27q7-8p7p-35vcCGA-2qxh-v67x-293cCGA-2vm3-2972-426mCGA-352v-3wf8-p369CGA-3g76-6vxx-262xCGA-3qmw-99mc-mr8mCGA-3w35-qfmp-6wg5CGA-56q3-86mq-gjmjCGA-8m7f-w4wf-prqxCGA-8v28-3mqx-x99rCGA-gfw9-p6cx-f325CGA-j24m-x535-mm9rCGA-mh5m-p75g-m5c5CGA-pv7c-g3v7-8c6mCGA-qvpr-jw93-m3h8CGA-v3p2-73pm-367fCGA-vwgq-9f76-x4mwCGA-wrwp-h26j-jxx7CGA-2ph3-g5gv-xhmwCGA-38j2-8c5j-r85mCGA-4982-7wfp-m8cjCGA-49jq-wf9r-f5phCGA-4qpj-8hvc-v3qcCGA-52v4-p82v-gqxgCGA-53qq-m3q5-fv2jCGA-5rp3-q4c4-gwmhCGA-6rqm-2w4q-9v7gCGA-g357-9qmh-6w8pCGA-hh48-7c54-284cCGA-jfm5-r43c-rf33CGA-jmxm-x96x-2q55CGA-m32f-w5fv-3rxrCGA-m3g5-xmrj-wf2fCGA-qg42-8wpx-rhg2CGA-rfrh-hhfj-768jCGA-rhxv-fcc4-mgx5CGA-rv89-fgj9-gqxhCGA-w76q-366c-46m9CGA-32p3-9jw4-q4cqCGA-3j47-g666-m86vCGA-3qph-h524-whm5CGA-4g8j-m694-44qmCGA-68vp-99j2-m974CGA-6r2m-v4gx-55w8CGA-73h3-4prp-vq58CGA-7j43-57rx-3jrcCGA-83gh-4wpp-g8p3CGA-8mj6-hxjp-vv88CGA-9h82-w69r-f9v4CGA-hxmj-rcpf-w5pfCGA-j293-jp9g-w74wCGA-wwrw-gj35-grq5
Advisory lineage Upstream: 0 Downstream: 11
Modified
Published: 18 Mar 2023, 00:00
Last modified:26 Feb 2025, 19:02

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
1.12% LOW
1% probability +0.86%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

18 Mar 2023, 00:00
Published
Vulnerability first disclosed
26 Feb 2025, 19:02
Last Modified
Vulnerability information updated

Description

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 1.12%• Percentile: 65%

Techniques & Countermeasures

  • CWE-770•Allocation of Resources Without Limits or Throttling

    The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected Systems

  • chainguard•cassandra-reaper

    < 4.0.1-r1

  • chainguard•eco-java-gradle-6.3

    all

  • chainguard•eco-java-gradle-6.4

    all

  • chainguard•eco-java-gradle-6.4.1

    all

  • chainguard•eco-java-gradle-6.5

    all

  • chainguard•eco-java-gradle-6.5.1

    all

  • chainguard•eco-java-gradle-6.6

    all

  • chainguard•eco-java-gradle-6.6.1

    all

  • chainguard•eco-java-gradle-6.7

    all

  • chainguard•eco-java-gradle-6.7.1

    all

  • chainguard•eco-java-gradle-6.8

    all

  • chainguard•eco-java-gradle-6.8.1

    all

  • chainguard•eco-java-gradle-6.8.2

    all

  • chainguard•eco-java-gradle-6.8.3

    all

  • chainguard•eco-java-gradle-6.9

    all

  • chainguard•eco-java-gradle-6.9.1

    all

  • chainguard•eco-java-gradle-6.9.2

    all

  • chainguard•eco-java-gradle-6.9.3

    all

  • chainguard•eco-java-gradle-6.9.4

    all

  • chainguard•eco-java-gradle-7.0

    all

  • chainguard•eco-java-gradle-7.0.1

    all

  • chainguard•eco-java-gradle-7.0.2

    all

  • chainguard•eco-java-gradle-7.1

    all

  • chainguard•eco-java-gradle-7.1.1

    all

  • chainguard•eco-java-gradle-7.2

    all

  • chainguard•eco-java-gradle-7.3

    all

  • chainguard•eco-java-gradle-7.3.1

    all

  • chainguard•eco-java-gradle-7.3.2

    all

  • chainguard•eco-java-gradle-7.3.3

    all

  • chainguard•eco-java-gradle-7.4

    all

  • chainguard•eco-java-gradle-7.4.1

    all

  • chainguard•eco-java-gradle-7.4.2

    all

  • chainguard•hadoop-fips-3.3.6

    all

  • chainguard•hadoop-fips-3.4.2

    all

  • chainguard•hadoop-fips-3.5

    all

  • chainguard•management-api-for-apache-cassandra-4.0

    < 0.1.89-r0

  • chainguard•management-api-for-apache-cassandra-4.0-compat

    < 0.1.89-r0

  • chainguard•management-api-for-apache-cassandra-4.1

    < 0.1.109-r0

  • chainguard•management-api-for-apache-cassandra-5.0

    < 0.1.89-r0

  • chainguard•management-api-for-apache-cassandra-5.0-compat

    < 0.1.89-r0

  • chainguard•scala-3.8

    < 3.8.4-r1

  • wolfi•cassandra-reaper

    < 4.0.1-r1

  • wolfi•management-api-for-apache-cassandra-5.0

    < 0.1.89-r0

  • wolfi•management-api-for-apache-cassandra-5.0-compat

    < 0.1.89-r0

  • wolfi•scala-3.8

    < 3.8.4-r1

  • debian•jackson-databind

    all | < 2.13.2.2-1 | < 2.13.2.2-1 | < 2.13.2.2-1

  • fasterxml•jackson-databind

    ≥ 2.10.0, < 2.12.6 | 2.13.0 | 2.13.0:rc1 | 2.13.0:rc2

  • com.fasterxml.jackson.core•jackson-databind

    ≥ 2.10.0, < 2.12.6 | ≥ 2.13.0, < 2.13.1

References (8)