# CVE-2022-42004: FasterXML jackson-databind resource exhaustion in BeanDeserializer

Source: https://junglewise.ai/threats/cve-2022-42004-fasterxml-jackson-databind-resource-exhaustion-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-10-03. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2022-42004 · Severity: high · CVSS 7.5 · Published 2022-10-03

FasterXML jackson-databind is a popular Java library used for converting data between Java objects and JSON. A vulnerability in how it handles specific data structures could allow an attacker to crash an application by sending a specially crafted request. This results in a denial-of-service, potentially making the affected system or service unavailable to legitimate users.

Technologies: [FasterXML Jackson Databind](https://junglewise.ai/threats/technologies/jackson-databind), [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind). Vendors: [FasterXML](https://junglewise.ai/threats/vendors/fasterxml), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2022-42004 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-42004 being exploited in the wild.

**How severe is CVE-2022-42004?** High severity, with a CVSS score of 7.5, published 3 October 2022.

**Which products and versions are affected?** com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.4.0-rc1,fixed=2.12.7.1.

**Is there a fix for CVE-2022-42004?** Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.12.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-42004 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-42004?** Check whether you run FasterXML Jackson Databind or com.fasterxml.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.12.7.1 or later

  ```sh
  # set com.fasterxml.jackson.core:jackson-databind to 2.12.7.1 in your pom.xml or build.gradle
  ```


## Technical details

A resource exhaustion vulnerability exists in FasterXML jackson-databind's BeanDeserializer._deserializeFromArray method. The component fails to properly validate or limit the depth of nested arrays during deserialization. This issue is specifically exploitable when the `UNWRAP_SINGLE_VALUE_ARRAYS` configuration is explicitly enabled. A remote, unauthenticated attacker can provide a maliciously crafted JSON payload with deeply nested arrays to trigger excessive resource consumption, leading to a Denial of Service (DoS). The vulnerability is addressed in versions 2.12.7.1 and 2.13.4.

## Affected products

- FasterXML jackson-databind >= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4

## Identifiers

- CVE-2022-42004
- GHSA-rgv9-q543-rqg4

## Timeline

- 2022-10-02: disclosed: NVD publication date
- 2022-10-03: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/AdamKorcz](https://api.github.com/users/AdamKorcz)
- [https://github.com/AdamKorcz](https://github.com/AdamKorcz)
- [https://api.github.com/users/AdamKorcz/gists%7B/gist_id%7D](https://api.github.com/users/AdamKorcz/gists%7B/gist_id%7D)
- [https://api.github.com/users/AdamKorcz/repos](https://api.github.com/users/AdamKorcz/repos)
- [https://avatars.githubusercontent.com/u/44787359?v=4](https://avatars.githubusercontent.com/u/44787359?v=4)
- [https://api.github.com/users/AdamKorcz/events%7B/privacy%7D](https://api.github.com/users/AdamKorcz/events%7B/privacy%7D)

## Related threats

- [jackson-databind type validation bypass in generic arguments](https://junglewise.ai/threats/cve-2026-110879-jackson-databind-validates-the-outer-class-of-a-class-name-type)
- [Jackson Protobuf Parser integer overflow in string key parsing](https://junglewise.ai/threats/cve-2026-110747-protobufparser-readstringkey-reads-the-length-prefix-of-a)
- [jackson-databind quadratic complexity in forward-reference resolution](https://junglewise.ai/threats/cve-2026-91777-jackson-databind-quadratic-forward-reference-completion)
- [FasterXML Jackson Databind unbounded cache growth on unknown type IDs](https://junglewise.ai/threats/cve-2026-91776-jackson-databind-retains-every-unknown-raw-type-id)
- [FasterXML jackson-databind quadratic parse in XML datatype deserialization](https://junglewise.ai/threats/cve-2026-68497-fasterxml-jackson-databind-quadratic-parse-in-xml-datatype)