CVE-2022-42003

What it actually does

This vulnerability is a denial-of-service condition in FasterXML jackson-databind primitive value deserialization. When the `UNWRAP_SINGLE_VALUE_ARRAYS` feature is enabled, jackson-databind versions before 2.13.4.1 and 2.12.17.1 do not adequately limit deeply nested wrapper arrays around primitive values. A remote, unauthenticated attacker who can submit JSON to an application endpoint parsed by vulnerable jackson-databind code can craft a highly nested array payload that causes excessive recursion, CPU consumption, stack exhaustion, memory pressure, or request-thread exhaustion. The impact is availability loss only; the flaw does not directly provide code execution, data disclosure, or data modification.

Why it matters to the business

Applications and APIs that accept JSON and use vulnerable jackson-databind versions may become slow, unresponsive, or crash when processing maliciously nested JSON. Because exploitation is network-accessible, low-complexity, unauthenticated, and public exploit techniques are available, internet-facing services, partner APIs, and internal high-volume services should be prioritized even though the vulnerability is not currently listed in CISA KEV and is not known to be used in ransomware campaigns. Operational consequences can include service outages, failed transactions, degraded customer experience, autoscaling cost increases, and incident-response disruption.

How an attack unfolds

An attacker first identifies an endpoint that accepts JSON and is backed by a Java application using a vulnerable jackson-databind version with `DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS` enabled. The attacker then sends a request containing a primitive field represented as deeply nested single-element arrays, for example a numeric, boolean, or string value wrapped in thousands of array levels. During deserialization, vulnerable jackson-databind repeatedly unwraps nested arrays without an effective depth check for primitive deserializers. This can consume excessive CPU, exhaust the Java stack, trigger memory pressure, or tie up request-handling threads. Repeated requests can amplify the effect and cause partial or complete denial of service. The provided threat-actor value does not identify a credible actor or campaign for this vulnerability, so defenders should treat exploitation risk as opportunistic rather than attribute-driven.

How to fix it

Upgrade FasterXML jackson-databind to a fixed release: 2.13.4.1 or later for the 2.13.x line, or 2.12.17.1 or later for the 2.12.x line. Where dependency metadata is source-based, ensure jackson-databind includes commit `d78d00ee7b5245b93103fef3187f70543d67ca33` or a later equivalent fix. Rebuild and redeploy all applications, containers, serverless packages, and shaded or bundled Java artifacts that include vulnerable jackson-databind copies. If immediate upgrade is not possible, disable `DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS` unless explicitly required, enforce strict request-body size and JSON nesting-depth limits at API gateways/WAFs, reject anomalously nested arrays, apply request timeouts and rate limits, and isolate vulnerable JSON-processing endpoints. Treat transitive dependencies carefully: jackson-databind is commonly pulled in through frameworks, SDKs, and platform libraries, so confirm the effective runtime version rather than only the direct dependency declaration.

How to confirm the fix worked

Confirm the effective runtime jackson-databind version is 2.13.4.1, 2.12.17.1, or a later non-vulnerable release using dependency tooling such as `mvn dependency:tree`, `gradle dependencies`, SBOM inspection, container image scanning, or direct JAR manifest/package inspection. Search built artifacts for embedded or shaded `jackson-databind` JARs and verify none are older vulnerable versions. Review application configuration and code for `DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS`; if it remains enabled, validate that upgraded libraries or compensating JSON depth controls are active. In a controlled non-production environment, send benign nested-array test payloads to JSON endpoints and confirm requests are rejected quickly with a client error, depth-limit error, or safe parsing failure rather than causing high CPU, stack traces, thread exhaustion, or process instability. Monitor after deployment for reduced parser exceptions, absence of `StackOverflowError` related to Jackson, and stable request latency under malformed JSON tests.

Typical attack path

1. Discover or guess JSON-accepting HTTP endpoints in a Java application or service.
2. Determine that the endpoint deserializes primitive values from JSON request bodies and may tolerate single-value array wrapping.
3. Send a crafted JSON payload with a primitive field wrapped in deeply nested arrays.
4. Cause vulnerable jackson-databind deserialization logic to recurse through nested arrays without adequate depth enforcement.
5. Trigger stack exhaustion, high CPU usage, memory pressure, request timeout, worker-thread exhaustion, or application crash.
6. Repeat requests or distribute them across connections to sustain service degradation or outage.

How to detect it

To determine whether this was already exploited, review logs and telemetry from JSON-ingesting applications, API gateways, WAFs, reverse proxies, load balancers, JVM runtimes, APM tools, and container/orchestrator platforms. Look for bursts of POST/PUT/PATCH requests with JSON bodies containing extreme nesting, especially long sequences of `[` characters around otherwise simple primitive values. Correlate those requests with sudden increases in HTTP 500/502/503/504 responses, request timeouts, JVM `StackOverflowError`, `OutOfMemoryError`, high CPU, thread-pool saturation, pod/container restarts, liveness probe failures, or autoscaling events. Application logs may show Jackson deserialization exceptions, recursion-related stack traces, or malformed JSON errors shortly before service degradation. Network and WAF telemetry should be checked for repeated requests from the same source or distributed sources targeting the same JSON endpoint with unusually large nesting depth but otherwise small semantic content. Because this vulnerability produces availability symptoms rather than a persistent compromise artifact, absence of files, processes, or registry changes is expected; detection should focus on request payload patterns and correlated runtime instability.

• java.lang.StackOverflowError
• java.lang.OutOfMemoryError
• com.fasterxml.jackson.databind.JsonMappingException
• com.fasterxml.jackson.core.JsonParseException
• com.fasterxml.jackson.databind.exc.MismatchedInputException
• DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS
• UNWRAP_SINGLE_VALUE_ARRAYS
• com.fasterxml.jackson.databind.deser.std.StdDeserializer
• com.fasterxml.jackson.databind.deser.std.NumberDeserializers
• com.fasterxml.jackson.databind.deser.std.StringDeserializer
• [[[[[[[[[[[[[[[[[[[[
• HTTP 500
• HTTP 502
• HTTP 503
• HTTP 504
• request timed out
• upstream timed out
• Read timed out
• liveness probe failed
• CrashLoopBackOff

What your security team should do

• Inventory all Java services and third-party products that include FasterXML jackson-databind, including transitive, shaded, and containerized copies.
• Prioritize internet-facing JSON APIs, authentication endpoints, ingestion services, and high-traffic internal APIs for immediate upgrade or mitigation.
• Upgrade jackson-databind to 2.13.4.1, 2.12.17.1, or later; where tracking source commits, verify inclusion of `d78d00ee7b5245b93103fef3187f70543d67ca33`.
• Disable `UNWRAP_SINGLE_VALUE_ARRAYS` where not required and add JSON nesting-depth, request-size, timeout, and rate-limit controls at application and edge layers.
• Create WAF/API-gateway detections for unusually deep repeated `[` characters in JSON request bodies, while tuning to avoid blocking legitimate nested JSON use cases.
• Hunt historical application, reverse-proxy, WAF, and JVM logs for signs of nested-array parsing failures, `StackOverflowError`, abnormal 5xx bursts, request timeouts, and CPU/memory spikes associated with JSON endpoints.
• Add dependency scanning or SBOM policy gates to prevent reintroduction of vulnerable jackson-databind versions in future builds.