4

CVE-2025-49128: fasterxml jackson-core

CVSS: 4.0v3.1MediumDeferred
AliasesUBUNTU-CVE-2025-49128DEBIAN-CVE-2025-49128CGA-267x-4vxx-924f
Published 06-06-2025Last modified 09-06-2025
Open JSON

Vulnerability summary

CVE-2025-49128 is a medium (CVSS 4.0) vulnerability in fasterxml jackson-core. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.9% of scored vulnerabilities.

Overall risk
16/100
0100
Low · default modelHow is this calculated?
CVSS score
4.0/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.39%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 3
CGA-679Q-PC95-XGM4CGA-CCQW-WH8F-FVMQCGA-W99F-H8P7-76RG

Timeline

  1. 06-06-2025
    PublishedVulnerability first disclosed.
  2. 09-06-2025
    Last modifiedVulnerability information updated.

Description

Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's `JsonLocation._appendSourceDesc` method allows up to 500 bytes of unintended memory content to be included in exception messages. When parsing JSON from a byte array with an offset and length, the exception message incorrectly reads from the beginning of the array instead of the logical payload start. This results in possible information disclosure in systems using pooled or reused buffers, like Netty or Vert.x. This issue was silently fixed in jackson-core version 2.13.0, released on September 30, 2021, via PR #652. All users should upgrade to version 2.13.0 or later. If upgrading is not immediately possible, applications can mitigate the issue by disabling exception message exposure to clients to avoid returning parsing exception messages in HTTP responses and/or disabling source inclusion in exceptions to prevent Jackson from embedding any source content in exception messages, avoiding leakage.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

32%

Versus all other CVEs

30-day change

0.00 pp

From 0.39% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard121 products
  • celeborn-0.5All versions (No fix recorded)
  • celeborn-0.6All versions (No fix recorded)
  • celeborn-0.7All versions (No fix recorded)
  • datadog-jmxfetch< 0.49.8-r1
  • druid< 37.0.0-r56 | < 37.0.0-r14
Wolfi8 products
  • celeborn-0.6All versions (No fix recorded)
  • datadog-jmxfetch< 0.49.8-r1
  • druid< 37.0.0-r56 | < 37.0.0-r14
  • scala-3.8< 3.8.4-r1
  • spark-4.0-scala-2.13< 4.0.3-r2
Com.fasterxml.jackson.core1 product
  • jackson-core≥ 2.0.0, < 2.13.0
Debian1 product
  • jackson-core< 2.13.0-1
Fasterxml1 product
Ubuntu1 product
  • jackson-coreAll versions (No fix recorded)

6 vendors · 133 products

References

10 links