CVE-2022-42004

What it actually does

This vulnerability is a denial-of-service condition in FasterXML jackson-databind before 2.13.4. When an application uses certain customized deserialization behavior, BeanDeserializer._deserializeFromArray can process attacker-supplied JSON containing deeply nested arrays without an adequate nesting-depth check. Repeated recursive processing can exhaust CPU, stack, or heap resources, causing request-handling threads to hang, throw StackOverflowError or OutOfMemoryError, or terminate the affected service. The issue does not provide code execution, data theft, or data modification by itself; the impact is availability loss.

Why it matters to the business

A remote unauthenticated attacker may be able to crash or degrade applications that accept JSON and deserialize it with vulnerable jackson-databind configurations. For internet-facing APIs, this can translate into service outages, failed transactions, degraded customer experience, autoscaling cost spikes, and operational incident response. Although it is not listed in CISA KEV and has a relatively low EPSS score, exploit code is available and jackson-databind is widely embedded in Java applications and downstream frameworks, so exposure may exist indirectly through application dependencies such as Quarkus or packaged tools such as Impacket.

How an attack unfolds

An attacker first identifies an HTTP endpoint, message consumer, RPC interface, or other input path that accepts JSON and is parsed by a vulnerable jackson-databind version. The vulnerable condition generally requires application-specific deserialization choices, so not every application using jackson-databind is exploitable. The attacker then sends a crafted JSON payload containing extremely deeply nested arrays to a code path that deserializes the payload into a Java bean type. Because the vulnerable BeanDeserializer._deserializeFromArray logic lacks sufficient checks for excessive nesting, processing recurses until application resources are exhausted. Successful exploitation appears as slow or failed requests, elevated CPU or memory use, thread pool exhaustion, StackOverflowError, OutOfMemoryError, container restarts, or service unavailability. The provided threat actor value appears to reference an unrelated jQuery XSS issue rather than a credible actor known to exploit this vulnerability, so detection should focus on generic denial-of-service attempts rather than actor-specific tradecraft.

How to fix it

Upgrade jackson-databind to 2.13.4 or later, or a currently supported newer branch, across all direct and transitive Java dependencies. For source-based tracking, FasterXML jackson-databind is fixed at commit 063183589218fec19a9293ed2f17ec53ea80ba88. Quarkus source references are fixed at commit 8cf9bdc360d16d44b060f8e4d85c1759acb5853c. Fortra Impacket source references are fixed at commit 49c643bf66620646884ed141c94e5fdd85bcdd2f, and Debian Impacket packages are fixed in 0.9.22-2 for Debian 11, 12, 13, and 14. Where immediate upgrade is not possible, reduce exposure by rejecting unusually deep JSON, enforcing request body size limits, applying API gateway or WAF rules for excessive nesting, setting parser-level maximum depth constraints where available, isolating JSON parsing workloads, and rate-limiting unauthenticated request paths. Review custom Jackson deserializers, coercion settings, and bean deserialization behavior because exploitability depends on application-specific configuration.

How to confirm the fix worked

Confirm dependency resolution, not only declared dependencies: inspect SBOMs, build output, dependency trees, shaded JARs, container images, and packaged application archives for jackson-databind versions earlier than 2.13.4. For Maven, use dependency:tree or an equivalent build scan; for Gradle, use dependencies or dependencyInsight; for containers, run an SCA scanner against the final image. Validate that no older jackson-databind JAR is bundled in WEB-INF/lib, BOOT-INF/lib, fat JARs, application server shared libraries, or plugin directories. After patching, run regression tests against JSON inputs with high nesting depth and verify the service rejects them predictably without excessive CPU, memory growth, StackOverflowError, or worker-thread exhaustion. Also confirm API gateways, reverse proxies, and application configuration enforce request size, timeout, rate, and JSON-depth limits for exposed endpoints.

Typical attack path

1. Discover a service endpoint or message-ingestion path that accepts attacker-controlled JSON.
2. Confirm or infer that the application uses a vulnerable jackson-databind release before 2.13.4 and a deserialization configuration affected by array-based bean deserialization.
3. Send a test payload with nested JSON arrays and observe latency, error behavior, or service instability.
4. Increase nesting depth or request concurrency to trigger stack, heap, CPU, or request-thread exhaustion.
5. Repeat requests to sustain denial of service, cause application restarts, or disrupt downstream processing.

How to detect it

To determine whether exploitation already occurred, review edge proxy, load balancer, API gateway, WAF, application, JVM, container, and APM telemetry for denial-of-service patterns against JSON endpoints. Focus on requests with application/json content types, unusually large counts of nested square brackets, high request body depth, repeated malformed JSON submissions, abnormal request duration, elevated 500 responses, and bursts from the same source addresses. In application logs, look for Java stack traces or error messages involving jackson-databind deserialization, especially BeanDeserializer._deserializeFromArray, StackOverflowError, OutOfMemoryError, request timeout exceptions, thread pool exhaustion, and abrupt process termination. In infrastructure telemetry, correlate suspicious request bursts with CPU saturation, heap growth, garbage collection pressure, pod or container restarts, JVM hs_err files, readiness/liveness probe failures, and autoscaling events. Because exploitation causes availability symptoms rather than a persistent implant, durable IOCs are usually limited to request artifacts, stack traces, crash files, and operational telemetry around the attack window.

• com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeFromArray
• java.lang.StackOverflowError
• java.lang.OutOfMemoryError: Java heap space
• JsonMappingException: Infinite recursion
• com.fasterxml.jackson.databind.JsonMappingException
• Content-Type: application/json
• [[[[[[[[[[[[[[[[[[[[
• hs_err_pid
• CrashLoopBackOff
• Readiness probe failed
• Liveness probe failed
• GC overhead limit exceeded
• request body too large
• maximum nesting depth
• StreamConstraintsException

What your security team should do

• Inventory all Java applications and packaged tools that include jackson-databind, including transitive and shaded dependencies.
• Prioritize remediation for internet-facing APIs, authentication endpoints, webhook receivers, message-ingestion services, and any service that accepts unauthenticated or high-volume JSON input.
• Upgrade jackson-databind to 2.13.4 or later, preferably to the latest supported release compatible with the application stack.
• Add or verify request body size limits, JSON nesting-depth limits, parsing timeouts, rate limits, and circuit breakers on JSON-processing endpoints.
• Search logs and APM telemetry for spikes in 4xx/5xx responses, request latency, JVM StackOverflowError, OutOfMemoryError, container restarts, and repeated requests with deeply nested JSON arrays.
• Review custom Jackson deserializers and deserialization features to determine whether the application uses the affected deserialization path.
• Create SIEM detections for repeated JSON requests containing excessive consecutive opening square brackets and for stack traces referencing BeanDeserializer._deserializeFromArray.
• If exploitation is suspected, preserve application logs, reverse proxy logs, request samples if legally and operationally permitted, JVM crash logs, heap dumps, and container restart events for timeline reconstruction.