CVE-2021-46877: Jackson-databind DOS Vulnerability

CVE-2021-46877 Overview

CVE-2021-46877 is a denial of service vulnerability affecting FasterXML jackson-databind versions 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1. The vulnerability allows attackers to cause excessive transient heap usage (approximately 2 GB per read operation) in uncommon situations involving JsonNode JDK serialization. This resource exhaustion issue can lead to service disruption and application crashes in Java applications that utilize the vulnerable jackson-databind library for JSON processing.

Critical Impact

Attackers can trigger massive memory consumption (2 GB transient heap per read) through crafted JsonNode serialization operations, potentially causing denial of service conditions in applications using affected jackson-databind versions.

Affected Products

• FasterXML jackson-databind versions 2.10.x through 2.12.x before 2.12.6
• FasterXML jackson-databind version 2.13.0 (including RC1 and RC2)
• FasterXML jackson-databind versions 2.13.x before 2.13.1

Discovery Timeline

• 2023-03-18 - CVE-2021-46877 published to NVD
• 2025-02-26 - Last updated in NVD database

Technical Details for CVE-2021-46877

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw resides in how jackson-databind handles JsonNode objects during JDK serialization operations. When specific serialization conditions are met, the library fails to properly limit memory allocation, resulting in excessive heap consumption.

The vulnerability is network-exploitable without requiring authentication or user interaction. An attacker who can influence the JSON data being processed by a vulnerable application may trigger the excessive memory allocation, leading to memory exhaustion and denial of service. While the attack complexity is low, it requires the application to be in an "uncommon situation" involving JsonNode JDK serialization, which somewhat limits the attack surface.

The impact is primarily focused on availability, with no direct confidentiality or integrity implications. However, in production environments, this memory exhaustion can cause cascading failures, especially in containerized or memory-constrained deployments.

Root Cause

The root cause of CVE-2021-46877 lies in improper resource allocation during JsonNode JDK serialization within the jackson-databind library. The vulnerability stems from a design flaw where the serialization process allocates approximately 2 GB of transient heap memory per read operation without implementing proper bounds checking or resource limits.

This occurs specifically in scenarios involving JsonNode objects being serialized through standard JDK serialization mechanisms. The library fails to account for the potential memory amplification that can occur during these operations, allowing specially crafted inputs to trigger disproportionate resource consumption.

Attack Vector

The attack vector for CVE-2021-46877 is network-based. An attacker can exploit this vulnerability by sending or causing the processing of JSON data that triggers the vulnerable JsonNode JDK serialization code path. The attack does not require any privileges or user interaction, making it particularly dangerous for publicly accessible services.

Exploitation involves crafting JSON payloads that, when processed by the vulnerable jackson-databind library through JsonNode JDK serialization, trigger the excessive memory allocation behavior. The transient nature of the heap usage means that repeated requests can quickly exhaust available memory resources, causing application crashes or severe performance degradation.

For technical implementation details, see the GitHub Issue Discussion where this vulnerability is documented.

Detection Methods for CVE-2021-46877

Indicators of Compromise

• Sudden spikes in JVM heap memory usage, particularly allocations approaching 2 GB increments
• Application OutOfMemoryError exceptions during JSON processing operations
• Increased garbage collection activity and GC pause times in Java applications using jackson-databind
• Service degradation or crashes in applications processing JSON data from untrusted sources

Detection Strategies

• Implement Software Composition Analysis (SCA) tools to identify vulnerable jackson-databind versions (2.10.x through 2.12.5 or 2.13.0)
• Monitor JVM heap metrics for anomalous memory allocation patterns during JSON deserialization
• Configure alerting on OutOfMemoryError occurrences in application logs
• Review dependency trees in Maven or Gradle projects for transitive dependencies on vulnerable versions

Monitoring Recommendations

• Enable JVM memory profiling and set up alerts for heap usage exceeding normal operational thresholds
• Implement application performance monitoring (APM) to track memory allocation during JSON processing
• Monitor container or process memory limits and restart patterns that may indicate exploitation attempts
• Log and analyze JSON payload sizes and serialization timing to identify potential attack patterns

How to Mitigate CVE-2021-46877

Immediate Actions Required

• Upgrade jackson-databind to version 2.12.6 or later for 2.12.x users
• Upgrade jackson-databind to version 2.13.1 or later for 2.13.x users
• Audit all Java applications and dependencies for vulnerable jackson-databind versions
• Implement memory limits on JVM instances to prevent complete system resource exhaustion

Patch Information

FasterXML has released patched versions of jackson-databind that address this vulnerability. Users should upgrade to the following versions:

• For 2.12.x branch: Upgrade to 2.12.6 or later
• For 2.13.x branch: Upgrade to 2.13.1 or later
• For newer versions: Use 2.14.x or 2.15.x releases which include the fix

The fix addresses the improper resource allocation during JsonNode JDK serialization. For complete details on the issue and resolution, refer to the GitHub Issue #3328 and the Jackson User Group discussion.

Workarounds

• If immediate patching is not possible, implement JVM heap size limits to prevent complete system memory exhaustion
• Consider implementing request size limits on JSON payloads to reduce exploitation potential
• Avoid using JDK serialization with JsonNode objects in untrusted contexts until the patch is applied
• Deploy rate limiting on endpoints that process JSON data to slow potential denial of service attempts

# Example Maven dependency update to patched version
# Update pom.xml jackson-databind version to 2.12.6 or later
mvn versions:use-dep-version -Dincludes=com.fasterxml.jackson.core:jackson-databind -DdepVersion=2.12.6

# Verify the updated dependency
mvn dependency:tree | grep jackson-databind