CVE-2025-49128: Jackson-core Information Disclosure Bug

CVE-2025-49128 Overview

Jackson-core, the foundational streaming parser and generator library used by Jackson Data Processor, contains an information disclosure vulnerability in versions 2.0.0 through 2.12.x. A flaw in the JsonLocation._appendSourceDesc method allows up to 500 bytes of unintended memory content to be included in exception messages when parsing JSON from a byte array with an offset and length parameter. The exception message incorrectly reads from the beginning of the array instead of the logical payload start, potentially exposing sensitive data in systems using pooled or reused buffers.

Critical Impact

Systems using buffer pooling frameworks like Netty or Vert.x may inadvertently leak sensitive memory contents through JSON parsing exception messages, potentially exposing authentication tokens, session data, or other sensitive information from previously processed requests.

Affected Products

• Jackson-core versions 2.0.0 through 2.12.x
• Applications using Jackson-core with byte array parsing and offset parameters
• Systems employing buffer pooling (Netty, Vert.x) with Jackson JSON parsing

Discovery Timeline

• 2025-06-06 - CVE CVE-2025-49128 published to NVD
• 2025-06-09 - Last updated in NVD database

Technical Details for CVE-2025-49128

Vulnerability Analysis

This vulnerability is classified as CWE-209 (Generation of Error Message Containing Sensitive Information). The core issue resides in how Jackson-core constructs exception messages when JSON parsing fails on byte arrays that have been passed with an offset and length specification.

When an application parses JSON data from a subset of a larger byte array (common in high-performance systems using buffer pools), Jackson is expected to only access the designated portion of the buffer. However, when a parsing error occurs, the _appendSourceDesc method in JsonLocation incorrectly references the beginning of the entire byte array rather than respecting the offset parameter. This causes up to 500 bytes of unrelated buffer content to be embedded in the exception message.

In environments like Netty or Vert.x where buffers are pooled and reused across different requests, this memory region may contain sensitive data from previous operations—such as authentication headers, API keys, or personally identifiable information from other users' requests.

Root Cause

The root cause lies in the JsonLocation._appendSourceDesc method's failure to properly account for the offset parameter when constructing source description content for exception messages. Instead of calculating the correct starting position within the byte array, the method reads from index zero, capturing unrelated memory content that precedes the actual JSON payload being parsed.

Attack Vector

This vulnerability requires local access to trigger, as an attacker would need to either control input that causes parsing exceptions or have access to application logs and error responses that include the malformed exception messages.

The attack scenario involves:

1. An attacker submits malformed JSON to an application using Jackson-core with buffer pooling
2. The parsing failure generates an exception message containing up to 500 bytes from the buffer pool
3. If the application returns this exception message in HTTP responses or logs it with insufficient redaction, sensitive data from other requests may be exposed

   * Contributed #573: More customizable TokenFilter inclusion (using `Tokenfilter.Inclusion`)
   (2.12.0)
 
+Greg Wittel (gwittel@github)
+  * Reported #652: Misleading exception for input source when processing byte buffer
+    with start offset
+  (2.13.0)
+
Ferenc Csaky (ferenc-csaky@github)
   * Contributed #677: Introduce O(n^1.5) BigDecimal parser implementation
   (2.13.0)
 
Fabian Meumertzheim (fmeum@github)
   * Reported #692: UTF32Reader ArrayIndexOutOfBoundsException
   (2.13.0)
-

Source: GitHub Commit

Detection Methods for CVE-2025-49128

Indicators of Compromise

• Exception messages in application logs containing unexpected binary or text data preceding the actual JSON payload
• HTTP error responses with Jackson parsing exceptions that include buffer content inconsistent with the request payload
• Reports of sensitive data appearing in unrelated error messages

Detection Strategies

• Audit application dependencies for jackson-core versions between 2.0.0 and 2.12.x
• Review exception handling code to identify locations where Jackson parsing exceptions are logged or returned to clients
• Monitor error logs for parsing exceptions that contain unexpectedly large source descriptions

Monitoring Recommendations

• Implement log monitoring for Jackson parsing exceptions containing unusual byte sequences or data patterns
• Configure application performance monitoring to flag exception messages exceeding expected lengths
• Enable buffer content inspection in staging environments to validate proper offset handling

How to Mitigate CVE-2025-49128

Immediate Actions Required

• Upgrade jackson-core to version 2.13.0 or later immediately
• Audit all exception handling code paths that may expose parsing errors to clients or logs
• Configure applications to suppress source content in Jackson exception messages as an interim measure

Patch Information

This issue was silently fixed in jackson-core version 2.13.0, released on September 30, 2021, via Pull Request #652. All users should upgrade to version 2.13.0 or later. The fix ensures that byte array offset parameters are properly respected when constructing exception message source descriptions.

For detailed information, refer to the GitHub Security Advisory GHSA-wf8f-6423-gfxg.

Workarounds

• Disable exception message exposure to clients by implementing exception handlers that sanitize or replace Jackson parsing errors before HTTP responses
• Disable source inclusion in exceptions by configuring Jackson to prevent embedding any source content in exception messages
• Implement output encoding for all error responses to prevent interpretation of leaked binary data

# Maven dependency update example
# Update pom.xml to use patched version
# <dependency>
#   <groupId>com.fasterxml.jackson.core</groupId>
#   <artifactId>jackson-core</artifactId>
#   <version>2.13.0</version>
# </dependency>