CVE-2022-42003: Jackson-databind DOS Vulnerability

CVE-2022-42003 Overview

CVE-2022-42003 is a resource exhaustion vulnerability in FasterXML jackson-databind, a popular Java library for processing JSON data. The vulnerability exists due to a lack of proper bounds checking in primitive value deserializers when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Attackers can exploit this flaw by crafting malicious JSON payloads with deeply nested wrapper arrays, leading to stack exhaustion and denial of service conditions.

Jackson-databind is widely used across the Java ecosystem for JSON serialization and deserialization, making this vulnerability particularly impactful for applications that process untrusted JSON input with the vulnerable configuration enabled.

Critical Impact
Applications using jackson-databind with UNWRAP_SINGLE_VALUE_ARRAYS enabled are vulnerable to denial of service attacks through crafted JSON payloads that cause resource exhaustion via deep array nesting.

Affected Products

FasterXML jackson-databind versions before 2.13.4.1 and 2.12.17.1
Quarkus (all versions using vulnerable jackson-databind)
Debian Linux 10.0 and 11.0
NetApp OnCommand Workflow Automation

Discovery Timeline

2022-10-02 - CVE-2022-42003 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-42003

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The flaw resides in the primitive value deserializers within jackson-databind, which fail to implement adequate depth checks when processing nested wrapper arrays. When the UNWRAP_SINGLE_VALUE_ARRAYS deserialization feature is enabled, the library automatically unwraps JSON arrays containing a single element into scalar values. However, the implementation lacks protection against recursive array nesting, allowing attackers to construct payloads with arbitrarily deep array hierarchies.

The attack exploits the recursive nature of the deserialization process. Each nested array level consumes stack frames, and sufficiently deep nesting can exhaust the JVM's stack space, resulting in a StackOverflowError and subsequent denial of service.

Root Cause

The root cause is the absence of a depth limit check in primitive value deserializers when handling the UNWRAP_SINGLE_VALUE_ARRAYS feature. The deserializers recursively process nested arrays without tracking or limiting the recursion depth, allowing unbounded stack consumption. This oversight permits maliciously crafted JSON documents to trigger uncontrolled recursion during deserialization.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can send a specially crafted JSON payload to any application endpoint that:

Uses a vulnerable version of jackson-databind
Has the UNWRAP_SINGLE_VALUE_ARRAYS feature enabled
Deserializes the attacker-controlled JSON input

The malicious payload consists of deeply nested single-element arrays containing a primitive value at the innermost level. When the deserializer attempts to unwrap these nested arrays, it recurses through each nesting level until stack exhaustion occurs.

text

#3559: Support `null`-valued `Map` fields with "any setter"
 #3568: Change `JsonNode.with(String)` and `withArray(String)` to consider
   argument as `JsonPointer` if valid expression
+#3590: Add check in primitive value deserializers to avoid deep wrapper array
+  nesting wrt `UNWRAP_SINGLE_VALUE_ARRAYS`
 
 2.13.4 (03-Sep-2022)

Source: GitHub Commit for Jackson Databind

The patch adds explicit depth checking in primitive value deserializers to prevent unbounded recursion when unwrapping single-value arrays.

Detection Methods for CVE-2022-42003

Indicators of Compromise

Unexpected StackOverflowError exceptions in application logs during JSON deserialization
Abnormally large or deeply nested JSON payloads in HTTP request logs
Application crashes or unresponsive behavior following JSON processing requests
Memory and CPU spikes correlated with JSON deserialization operations

Detection Strategies

Monitor application logs for java.lang.StackOverflowError exceptions in jackson-databind call stacks
Implement request payload size limits and JSON depth validation at the API gateway or application layer
Use Software Composition Analysis (SCA) tools to identify vulnerable jackson-databind versions in your dependency tree
Deploy web application firewalls with rules to detect and block anomalously nested JSON structures

Monitoring Recommendations

Configure alerts for elevated error rates related to JSON parsing or deserialization failures
Monitor JVM metrics for unusual stack memory consumption patterns
Implement logging for deserialization operations that exceed expected depth thresholds
Track dependency versions across your application portfolio to identify systems running vulnerable jackson-databind releases

How to Mitigate CVE-2022-42003

Immediate Actions Required

Upgrade jackson-databind to version 2.13.4.1 or 2.12.17.1 or later immediately
Audit your codebase for usage of the UNWRAP_SINGLE_VALUE_ARRAYS deserialization feature
Review and update all applications and services that depend on jackson-databind
Implement input validation to reject excessively nested JSON documents before deserialization

Patch Information

FasterXML has released patched versions that add depth checking in primitive value deserializers. The fix is available in jackson-databind versions 2.13.4.1 and 2.12.17.1 and all subsequent releases. The specific commit implementing the fix can be reviewed at the GitHub Commit for Jackson Databind.

Additional security advisories have been issued by downstream distributors including Debian DSA-5283 Security Notice, Debian LTS Announcement November 2022, Gentoo GLSA 202210-21, and NetApp Security Advisory NTAP-20221124-0004.

Workarounds

Disable the UNWRAP_SINGLE_VALUE_ARRAYS feature if it is not required for your application functionality
Implement pre-deserialization validation to limit JSON document nesting depth
Use streaming JSON parsers with manual depth tracking for processing untrusted input
Deploy application-layer rate limiting and payload size restrictions to reduce attack surface

bash

# Maven dependency update example
# Update pom.xml to use patched jackson-databind version
# Replace existing version with:
# <dependency>
#   <groupId>com.fasterxml.jackson.core</groupId>
#   <artifactId>jackson-databind</artifactId>
#   <version>2.13.4.1</version>
# </dependency>

# Verify installed version
mvn dependency:tree | grep jackson-databind