CVE-2022-42003: Jackson-databind DOS Vulnerability

CVE-2022-42003 Overview

CVE-2022-42003 is a resource exhaustion vulnerability in FasterXML jackson-databind, a popular Java library for processing JSON data. The vulnerability exists due to a lack of proper bounds checking in primitive value deserializers when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Attackers can exploit this flaw by crafting malicious JSON payloads with deeply nested wrapper arrays, leading to stack exhaustion and denial of service conditions.

Jackson-databind is widely used across the Java ecosystem for JSON serialization and deserialization, making this vulnerability particularly impactful for applications that process untrusted JSON input with the vulnerable configuration enabled.

Critical Impact

Applications using jackson-databind with UNWRAP_SINGLE_VALUE_ARRAYS enabled are vulnerable to denial of service attacks through crafted JSON payloads that cause resource exhaustion via deep array nesting.

Affected Products

• FasterXML jackson-databind versions before 2.13.4.1 and 2.12.17.1
• Quarkus (all versions using vulnerable jackson-databind)
• Debian Linux 10.0 and 11.0
• NetApp OnCommand Workflow Automation

Discovery Timeline

• 2022-10-02 - CVE-2022-42003 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-42003

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The flaw resides in the primitive value deserializers within jackson-databind, which fail to implement adequate depth checks when processing nested wrapper arrays. When the UNWRAP_SINGLE_VALUE_ARRAYS deserialization feature is enabled, the library automatically unwraps JSON arrays containing a single element into scalar values. However, the implementation lacks protection against recursive array nesting, allowing attackers to construct payloads with arbitrarily deep array hierarchies.

The attack exploits the recursive nature of the deserialization process. Each nested array level consumes stack frames, and sufficiently deep nesting can exhaust the JVM's stack space, resulting in a StackOverflowError and subsequent denial of service.

Root Cause

The root cause is the absence of a depth limit check in primitive value deserializers when handling the UNWRAP_SINGLE_VALUE_ARRAYS feature. The deserializers recursively process nested arrays without tracking or limiting the recursion depth, allowing unbounded stack consumption. This oversight permits maliciously crafted JSON documents to trigger uncontrolled recursion during deserialization.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can send a specially crafted JSON payload to any application endpoint that:

1. Uses a vulnerable version of jackson-databind
2. Has the UNWRAP_SINGLE_VALUE_ARRAYS feature enabled
3. Deserializes the attacker-controlled JSON input

The malicious payload consists of deeply nested single-element arrays containing a primitive value at the innermost level. When the deserializer attempts to unwrap these nested arrays, it recurses through each nesting level until stack exhaustion occurs.

#3559: Support `null`-valued `Map` fields with "any setter"
 #3568: Change `JsonNode.with(String)` and `withArray(String)` to consider
   argument as `JsonPointer` if valid expression
+#3590: Add check in primitive value deserializers to avoid deep wrapper array
+  nesting wrt `UNWRAP_SINGLE_VALUE_ARRAYS`
 
 2.13.4 (03-Sep-2022)

Source: GitHub Commit for Jackson Databind

The patch adds explicit depth checking in primitive value deserializers to prevent unbounded recursion when unwrapping single-value arrays.

Detection Methods for CVE-2022-42003

Indicators of Compromise

• Unexpected StackOverflowError exceptions in application logs during JSON deserialization
• Abnormally large or deeply nested JSON payloads in HTTP request logs
• Application crashes or unresponsive behavior following JSON processing requests
• Memory and CPU spikes correlated with JSON deserialization operations

Detection Strategies

• Monitor application logs for java.lang.StackOverflowError exceptions in jackson-databind call stacks
• Implement request payload size limits and JSON depth validation at the API gateway or application layer
• Use Software Composition Analysis (SCA) tools to identify vulnerable jackson-databind versions in your dependency tree
• Deploy web application firewalls with rules to detect and block anomalously nested JSON structures

Monitoring Recommendations

• Configure alerts for elevated error rates related to JSON parsing or deserialization failures
• Monitor JVM metrics for unusual stack memory consumption patterns
• Implement logging for deserialization operations that exceed expected depth thresholds
• Track dependency versions across your application portfolio to identify systems running vulnerable jackson-databind releases

How to Mitigate CVE-2022-42003

Immediate Actions Required

• Upgrade jackson-databind to version 2.13.4.1 or 2.12.17.1 or later immediately
• Audit your codebase for usage of the UNWRAP_SINGLE_VALUE_ARRAYS deserialization feature
• Review and update all applications and services that depend on jackson-databind
• Implement input validation to reject excessively nested JSON documents before deserialization

Patch Information

FasterXML has released patched versions that add depth checking in primitive value deserializers. The fix is available in jackson-databind versions 2.13.4.1 and 2.12.17.1 and all subsequent releases. The specific commit implementing the fix can be reviewed at the GitHub Commit for Jackson Databind.

Additional security advisories have been issued by downstream distributors including Debian DSA-5283 Security Notice, Debian LTS Announcement November 2022, Gentoo GLSA 202210-21, and NetApp Security Advisory NTAP-20221124-0004.

Workarounds

• Disable the UNWRAP_SINGLE_VALUE_ARRAYS feature if it is not required for your application functionality
• Implement pre-deserialization validation to limit JSON document nesting depth
• Use streaming JSON parsers with manual depth tracking for processing untrusted input
• Deploy application-layer rate limiting and payload size restrictions to reduce attack surface

# Maven dependency update example
# Update pom.xml to use patched jackson-databind version
# Replace existing version with:
# <dependency>
#   <groupId>com.fasterxml.jackson.core</groupId>
#   <artifactId>jackson-databind</artifactId>
#   <version>2.13.4.1</version>
# </dependency>

# Verify installed version
mvn dependency:tree | grep jackson-databind