CVE-2025-52999
Aliases:GHSA-h46c-h94j-95f3DEBIAN-CVE-2025-52999RHSA-2025:11473RHSA-2025:12280RHSA-2025:12281RHSA-2025:12282RHSA-2025:12283RHSA-2025:14116RHSA-2025:14117RHSA-2025:14118RHSA-2025:14126RHSA-2025:14127CGA-24fg-xcp5-rwgcCGA-29gf-7vqc-xhm8CGA-3m6w-f9jw-q7f3CGA-3qv3-29jm-vq7rCGA-3whj-x54r-m97gCGA-46vm-39mc-33h6CGA-496m-5g2x-95fxCGA-4cwv-6pxw-8cvhCGA-558q-fjq7-85jpCGA-567v-6x2g-8v35CGA-63fw-344q-hww6CGA-65r7-86pg-6hxfCGA-6vff-vj9q-v9vqCGA-6w35-m99g-9gvxCGA-7frh-77j4-q943CGA-7h2r-5255-8fc7CGA-8j98-4jjm-mh35CGA-9fwj-mg75-vp6jCGA-9gr3-f6mv-g9g6CGA-f5p2-prjr-52fwCGA-f6cg-32x5-qcjjCGA-g5h3-mq4w-84r8CGA-gpr3-rvp4-5gxhCGA-j985-6742-p3jhCGA-mcm9-qr44-3h74CGA-mf7v-h825-g52wCGA-pwmq-374q-h4m9CGA-22j4-hq4f-jx4qCGA-22vc-j52w-89r6CGA-23r3-3fq4-2frvCGA-242w-w9jw-whh2CGA-24h5-3hf4-4rcqCGA-24vf-prmx-vjr6CGA-2958-chm9-8f42CGA-2f7p-r9gg-hcv5CGA-2m88-89hx-6crwCGA-33c8-q7vg-pqgjCGA-34g8-5367-m9c4CGA-3f5m-j7qw-q7vgCGA-3fwg-fqmf-r3vgCGA-3g7r-fprg-x2whCGA-3gvf-c95h-72rqCGA-3hx7-3fjm-h26jCGA-3jf2-v94r-3g9mCGA-43pm-78r5-97vjCGA-44vv-4wj7-gfgwCGA-45r7-v86j-wxwgCGA-4634-27vr-r6mwCGA-465f-9fq4-fqxgCGA-474w-g8fw-2pcvCGA-4g36-v555-hg9vCGA-4jx4-8ccr-cq42CGA-4x56-4555-wj2vCGA-4x58-f567-mqgcCGA-4x8j-6pc6-2g83CGA-53jq-3cxj-74gvCGA-53x9-9rrr-5x3xCGA-562h-g3j8-fv4fCGA-5jh5-4qh9-f4mfCGA-5jx3-qcg4-p75gCGA-5vmp-pggg-469cCGA-5whw-m88r-prfhCGA-639f-qgcw-mqw7CGA-65f7-6pmr-598cCGA-6666-r2h7-rf57CGA-6f8x-9pxj-2pm9CGA-6j2w-jpww-j28cCGA-6rwc-gq4q-4rc9CGA-6v2j-xgm7-2q8wCGA-74x4-265q-xwmhCGA-772r-j3vx-g4gfCGA-7cxx-m68w-w9p8CGA-7jgv-r7vh-37cvCGA-7mhj-gjrr-6973CGA-895h-x5h4-cvfqCGA-8cfj-cj52-gppfCGA-8fqv-qrwc-qhj3CGA-8ghm-g9hq-7h9vCGA-8gm4-g42x-2ch7CGA-8m49-rvgj-m8qpCGA-8pc6-7p7f-38vxCGA-8vcj-3h6h-97vqCGA-8vr4-qrhm-2468CGA-8w27-pvv7-5q75CGA-8x5f-3h3p-jjh4CGA-928m-x8vm-f4jvCGA-96fp-5xrc-jv6cCGA-9cjr-3h62-g9c6CGA-9fmm-mh6h-4ghvCGA-9h3r-crff-68fhCGA-9rqw-q7jx-ggfmCGA-9vpf-jrjx-5j8qCGA-c582-62g4-xvpcCGA-c5xp-fmqm-wpvvCGA-c8r3-m7hg-66prCGA-cgh7-j7mq-mmmwCGA-cgm2-x872-m2wrCGA-cmhf-2vgh-f439CGA-cwxq-8mph-38wmCGA-f567-mv5r-8pvpCGA-f6gv-3xcq-g988CGA-fhf7-grxf-66x5CGA-fjmw-phx4-638wCGA-fm66-8fcq-7f2mCGA-fp45-x8vp-29fhCGA-fpv5-98r7-8rcqCGA-fwrw-h59m-rv64CGA-g48h-4cwc-8q6hCGA-g49x-gxp4-jrpvCGA-g74q-mq9w-gjw8CGA-gjvc-29gh-9pp9CGA-gpg4-v3f4-p4mvCGA-gppc-6p4x-c853CGA-hcqf-jx6x-x2j3CGA-hfgf-2g34-7vvxCGA-hfhq-jj55-rv22CGA-hmpj-5rpf-4f2qCGA-hmvq-prq6-xpjjCGA-j247-rf42-pjj9CGA-j35c-xcc6-p3r2CGA-j367-qr73-jj7rCGA-j393-4c23-6q35CGA-jc3f-h5r9-4fcfCGA-jcfw-4q3x-wp3fCGA-jgf8-5p36-94q6CGA-jgv6-3ghj-jvggCGA-jhcf-2mpw-pqfcCGA-jhcp-f37j-g844CGA-jhqr-h3mf-9xx3CGA-jrqc-c53r-cv7hCGA-jw62-wh35-5rxgCGA-jx93-g9h6-68cpCGA-jxg5-cm87-jp25CGA-m3gc-795p-9fmrCGA-m65j-754p-xfhmCGA-m88r-c47r-3fccCGA-mgh5-j4r3-jgf6CGA-mp6p-f473-5xq7CGA-mqr3-3vm7-gwpmCGA-mvpc-47v2-wq3rCGA-p77f-2rrh-p3f3CGA-phjg-v7pj-rjj3CGA-pqjg-m87w-34ffCGA-pr3r-2qgr-8cq4CGA-pv67-pp8g-wpf8CGA-q5xq-2r23-j239CGA-qh66-45f4-8x6fCGA-qphf-f4xp-pfcvCGA-qr9f-fc39-h4j2CGA-qw2x-r2jg-4wqwCGA-qwmw-7xcj-rv79CGA-qxcm-f8p4-4rwpCGA-r7q9-vj4m-4q4hCGA-rcxm-27f9-38m9CGA-rgrj-2g5c-793fCGA-rpvg-fh7m-q499CGA-rv34-gc8g-qmg3CGA-rwp5-2h9r-v4qmCGA-rxc7-7842-rgxqCGA-rxr8-h868-gc57CGA-v4hh-83q3-hh8jCGA-v79f-5442-qw4rCGA-vc3x-73fg-qgwxCGA-vc8c-gqwj-426fCGA-vmfj-326h-rcmfCGA-vpm6-fv89-v29cCGA-vq6g-rxc2-782hCGA-vvg6-j8rm-jv4qCGA-w29h-42r9-v74fCGA-w49q-mr86-3fhrCGA-w4m9-72j4-77w7CGA-w5rw-7jr6-mggxCGA-wgj3-8rp6-qfh5CGA-wjmw-3chx-98w9CGA-wp29-2pm5-v2q7CGA-wq33-h267-c882CGA-x29f-r47v-9h4mCGA-x2xr-q47w-p8cgCGA-x78f-rwfw-mwv6CGA-xc3v-6v9q-rp92CGA-xc93-cp6h-3w43CGA-xmg7-hj2g-q625CGA-xq48-mfqr-wvw9CGA-xqm7-6qr3-2qvmCGA-25fh-cwq9-6wgxCGA-29m3-w4r7-75hjCGA-2cx8-m983-rfxhCGA-2mgc-29rw-7433CGA-34hj-44pq-w4q7CGA-36g5-5h74-6m9cCGA-3j84-9xpx-fgvcCGA-4wcv-4xf5-h8p6CGA-5rxv-wqwg-wcj9CGA-5wh6-55cj-7h3rCGA-6jq2-5x7r-4h5fCGA-6w7x-4544-3765CGA-7656-3w45-q3hpCGA-7hvc-3973-x7rhCGA-7pmg-679w-h883CGA-8667-qjrp-6gfxCGA-8cxv-jj5m-cr8vCGA-8v4j-wp57-pv45CGA-cjqr-4j49-8hq2CGA-cp7x-245j-jpr2CGA-cwfx-f9cc-p98fCGA-f775-6rm7-wc3wCGA-gmqw-xr5f-9g3vCGA-gvmm-v33g-fjxcCGA-h4r5-q83v-h3vgCGA-h635-9jxw-hcv4CGA-h8h9-36vc-vgf8CGA-hgf9-6hpj-vwp2CGA-jg53-9535-4mjhCGA-jh44-25rm-gg97CGA-jr66-mqgw-j28fCGA-m2f4-m8hm-f5rrCGA-m7wg-326g-m8frCGA-mfph-33mg-52x8CGA-mpww-mgm4-xf55CGA-p26j-4w44-j6q7CGA-q3hq-46vg-mvvfCGA-q7pj-257p-76rcCGA-q7xx-347p-245vCGA-rx9p-7m65-9v8cCGA-v2q2-hrcv-54r5CGA-v4ww-29xc-gr69CGA-vqm7-x689-7gg4CGA-wvg7-mr6f-v2q9CGA-x9p4-9jq9-2jrxCGA-xcc2-4gvh-p8chCGA-xvp7-58v6-j284CGA-24mx-m7cg-c7vrCGA-2hr9-25w8-4wv2CGA-2vvv-xj3x-86vrCGA-3687-f743-xhcqCGA-36mg-jmx9-hg39CGA-37mq-whfh-fh6rCGA-3gm4-9224-6ww9CGA-3pjr-xmmh-9hghCGA-3vrq-87qc-27pvCGA-4px6-8x7j-ghmxCGA-4qcv-99gr-25p4CGA-4rcr-44wf-47w7CGA-4vv8-93ph-9vm9CGA-4wp6-c59j-w2vhCGA-4x4g-qjfw-c769CGA-55f6-rhvq-c339CGA-56vw-3pph-96gqCGA-57h4-v4f4-9qg2CGA-5pp9-pw76-7fw4CGA-5qw5-4g5v-fjc3CGA-5x6h-42vq-fc65CGA-5xh5-72hg-4w7wCGA-68mg-xc73-847jCGA-6gwr-cwj4-hqc8CGA-6mg2-g2x5-h8qrCGA-6pcx-9qcc-4v87CGA-6v5j-mxqp-2j5jCGA-729c-ffv7-vvfgCGA-72j7-g9r9-jw8cCGA-7477-7wc4-rjhrCGA-797m-qr3m-2cr2CGA-7p5g-fr4v-g372CGA-7xhx-hfh2-49vmCGA-847j-2c87-qw27CGA-8x44-9pcw-wqphCGA-8xwr-c7q2-hrqwCGA-97rp-gq6m-h8xqCGA-987h-9hxc-j75jCGA-c3xf-f5rp-5cq7CGA-c676-7535-cprfCGA-cj55-fwcg-m27wCGA-cq4g-28f6-jfphCGA-f6gc-8362-gfxcCGA-f82w-w2hf-8qrcCGA-fgj9-j7cx-rqrcCGA-fpvg-jrv6-rpfmCGA-g328-79mw-9w9pCGA-g8x9-xxr9-8385CGA-g9xm-jhr6-j2q8CGA-gfpg-37p4-r6vgCGA-gpg2-r7rr-2cgwCGA-h3rw-mgp7-wj57CGA-hj8c-5cm5-cg2mCGA-hx2p-hgp4-qjhfCGA-j2v9-hvwf-9pp2CGA-j5h6-m9cr-j633CGA-jc32-7j34-rghhCGA-jc7w-784c-vhv5CGA-jj26-c57v-hjffCGA-jwqc-w4h9-vhmvCGA-mfc3-95vm-c38hCGA-mfvp-gvxc-j36mCGA-mgv4-c87f-j87hCGA-mr2w-83gf-fc7gCGA-q22p-7v7c-j386CGA-q33w-qx9j-74rxCGA-q5m3-43c7-2p3hCGA-q7q8-7cmp-gw6hCGA-qm3q-f4p2-v9wfCGA-r7rm-jm9f-q59cCGA-rfrp-mvpg-62whCGA-rx6r-8rg8-vv9wCGA-v6hf-mgcc-f8p2CGA-vhrq-56m5-fwfvCGA-x8qm-4764-gr98CGA-x99x-pfpj-qvgxCGA-xq6j-44hh-x35hCGA-2qv2-x36q-7hm6CGA-2w6c-87hr-v6r5CGA-2xcw-wj4f-m648CGA-36wj-vv3p-jp5cCGA-376c-2f84-4x97CGA-3jfw-hc44-g8rqCGA-3v9q-h9jg-gwxjCGA-4jcj-hhx3-ww33CGA-4mgg-7r9h-qw28CGA-56m3-v8f5-xmpgCGA-5q9h-vf5c-g75gCGA-63w7-9phw-326vCGA-6fv5-mcjm-r4r4CGA-6pf8-66r9-2jwfCGA-72m7-g92x-9q37CGA-74q5-q236-jq2vCGA-7cg6-gqwv-cwfmCGA-7vvj-gv9f-p53wCGA-83xf-wpfx-j29pCGA-85r4-gh9r-2qf5CGA-938p-xhcx-5wh4CGA-9f57-v92q-7g2qCGA-9fhq-cj3r-6chqCGA-c35v-639j-gxr4CGA-cfhh-r2c3-f42cCGA-cvjf-4w9x-3769CGA-cxf8-wj6r-g948CGA-ffw4-vm63-g737CGA-fr7j-p9g8-635fCGA-fvjg-3vc6-369pCGA-fvxf-89p3-5h62CGA-g3jr-2hgg-79w3CGA-gh2r-pvhw-gm53CGA-gj4x-66f7-xmggCGA-h3r9-cwc6-v4q5CGA-h629-vx2r-mgc5CGA-hxq8-9v86-hv7hCGA-jvcc-7pwp-vj8vCGA-m7fw-xv3x-r6v2CGA-mgf5-7p54-qv4jCGA-mhrf-985j-5m5pCGA-p24c-p6g3-9fw5CGA-p8wp-cwmm-52p9CGA-pfhv-72qg-fr4hCGA-pp99-vjv3-6mfxCGA-q5hj-fxrw-m53xCGA-q5mx-mmqv-xj87CGA-qfqc-hmgp-5789CGA-qfv3-w9h7-h22wCGA-qj4p-6v8m-q829CGA-rc82-6g6q-299pCGA-rgjf-wrvw-6wv6CGA-rh4h-ggp6-wf9mCGA-v29p-wwr6-m32vCGA-v9fm-5vfc-4j4gCGA-vc74-jr93-gc95CGA-wqjj-47vx-6rqwCGA-xfjp-23qx-mcj3CGA-6jp3-99px-rfr7CGA-fc77-6rqf-3pr7
Advisory lineage Upstream: 0 Downstream: 24
Deferred
Published: 25 Jun 2025, 17:02
Last modified:25 Jun 2025, 18:04
Vulnerability Summary
Overall Risk (default)
medium
35/100 CVSS Score
8.7 HIGH
v4.0 (cve.org)
EPSS Score
0.72% LOW
1% probability +0.69%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
25 Jun 2025, 17:02
Published
Vulnerability first disclosed
25 Jun 2025, 18:04
Last Modified
Vulnerability information updated
Description
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.
CVSS Metrics
- v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.72%• Percentile: 52%
Techniques & Countermeasures
- CWE-121•Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Affected Systems
- chainguard•cassandra-4.0
< 4.0.18-r1
- chainguard•cassandra-4.0-compat
< 4.0.18-r1
- chainguard•cassandra-4.0-iamguarded-compat
< 4.0.18-r1
- chainguard•cassandra-4.1
< 4.1.9-r1
- chainguard•cassandra-4.1-compat
< 4.1.9-r1
- chainguard•cassandra-4.1-iamguarded-compat
< 4.1.9-r1
- chainguard•cassandra-fips-4.0
< 4.0.15-r2
- chainguard•cassandra-fips-4.0-compat
< 4.0.15-r2
- chainguard•cassandra-fips-4.1
< 4.1.7-r2
- chainguard•cassandra-fips-4.1-compat
< 4.1.7-r2
- chainguard•cassandra-fips-5.0
< 5.0.3-r5
- chainguard•cassandra-fips-5.0-compat
< 5.0.3-r5
- chainguard•cassandra-reaper
< 3.8.0-r6
- chainguard•celeborn-0.5
< 0.5.4-r18 | < 0.5.4-r19
- chainguard•celeborn-0.6
all
- chainguard•celeborn-0.7
all
- chainguard•confluent-common-docker
< 7.6.0-r16
- chainguard•confluent-common-docker-base
< 7.6.0-r16
- chainguard•cqlsh-5.0
< 5.0.3-r5
- chainguard•cqlsh-fips-5.0
< 5.0.3-r5
- chainguard•druid
all | < 37.0.0-r14 | < 37.0.0-r56
- chainguard•eco-java-gradle-2.10
all
- chainguard•eco-java-gradle-2.11
all
- chainguard•eco-java-gradle-2.12
all
- chainguard•eco-java-gradle-2.13
all
- chainguard•eco-java-gradle-2.14
all
- chainguard•eco-java-gradle-2.14.1
all
- chainguard•eco-java-gradle-2.4
all
- chainguard•eco-java-gradle-2.5
all
- chainguard•eco-java-gradle-2.6
all
- chainguard•eco-java-gradle-2.7
all
- chainguard•eco-java-gradle-2.8
all
- chainguard•eco-java-gradle-2.9
all
- chainguard•eco-java-gradle-3.0
all
- chainguard•eco-java-gradle-3.1
all
- chainguard•eco-java-gradle-3.2
all
- chainguard•eco-java-gradle-3.2.1
all
- chainguard•eco-java-gradle-3.3
all
- chainguard•eco-java-gradle-3.4
all
- chainguard•eco-java-gradle-3.4.1
all
- chainguard•eco-java-gradle-3.5
all
- chainguard•eco-java-gradle-3.5.1
all
- chainguard•eco-java-gradle-4.0
all
- chainguard•eco-java-gradle-4.0.1
all
- chainguard•eco-java-gradle-4.0.2
all
- chainguard•eco-java-gradle-4.1
all
- chainguard•eco-java-gradle-4.10
all
- chainguard•eco-java-gradle-4.10.1
all
- chainguard•eco-java-gradle-4.10.2
all
- chainguard•eco-java-gradle-4.10.3
all
Showing first 50 affected entries in server-rendered view.
References (32)
- https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3
- https://github.com/FasterXML/jackson-core/pull/943
- https://nvd.nist.gov/vuln/detail/CVE-2025-52999
- https://github.com/FasterXML/jackson-core
- https://security-tracker.debian.org/tracker/CVE-2025-52999
- https://access.redhat.com/errata/RHSA-2025:11473
- https://access.redhat.com/security/updates/classification/#important
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index
- https://bugzilla.redhat.com/show_bug.cgi?id=2374804
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11473.json
- https://access.redhat.com/security/cve/CVE-2025-52999
- https://www.cve.org/CVERecord?id=CVE-2025-52999
- https://access.redhat.com/errata/RHSA-2025:12280
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12280.json
- https://access.redhat.com/errata/RHSA-2025:12281
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12281.json
- https://access.redhat.com/errata/RHSA-2025:12282
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12282.json
- https://access.redhat.com/errata/RHSA-2025:12283
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12283.json
- https://access.redhat.com/errata/RHSA-2025:14116
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14116.json
- https://access.redhat.com/errata/RHSA-2025:14117
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14117.json
- https://access.redhat.com/errata/RHSA-2025:14118
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14118.json
- https://access.redhat.com/errata/RHSA-2025:14126
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14126.json
- https://access.redhat.com/errata/RHSA-2025:14127
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14127.json
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52999.json