jackson-coreutils BigDecimal Amplification DoS (CWE-400) Analysis and Fix

Vulnerability Key Information Summary Vulnerability Overview Title: [Security] BigDecimal Amplification DoS via Default Configuration #65 Status: Open Type: CWE-400 (Uncontrolled Resource Consumption) CVSS 3.1 Score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/H:A) Root Cause: The default configuration of enables and . When an application parses untrusted JSON containing large numeric values (e.g., ), allocates a string proportional to the exponent, causing memory amplification. Trigger Conditions: No SSRF is required; any direct JSON input (HTTP request body, uploaded file, message queue payload) can trigger this vulnerability. Scope of Impact Affected Versions: 2.0 (latest on Maven Central) Affected Components: Default configuration of in Affected Files: Impact: - Denial of Service (DoS): A single small request can cause a JVM - Amplification Factor: 12,500x (8-byte input → 100,000-character output) - No Authentication Required: Any endpoint accepting JSON can be exploited - Downstream User Impact: is a transitive dependency of (widely used) Affected Downstream Libraries (2.2.14, 26k+ GitHub dependencies) (1.13) Remediation (Recommended Mitigations) 1. Remove from the default configuration (breaking change but safer): 2. Add a scale validation check before serialization: 3. Upgrade Jackson to 2.15+, which introduces . POC / Exploit Code Minimal Reproduction Code Attack Scenario 1. Attacker sends JSON body: (20 bytes) 2. Application parses it via ( is created due to ) 3. Application subsequently serializes the node (e.g., logging, caching, forwarding to downstream) 4. attempts to allocate a ~2GB string 5. JVM throws → Application crashes Proof of Concept (Verified on OpenJDK 21 runtime) References Jackson (2.15+): https://github.com/FasterXML/jackson-core/blob/2.15/... Related Issue: [Security] SSRF + BigDecimal Amplification Remote DoS Chain via CWE-400: https://www.cwe.org/definitions/400.html

Goal Reached Thanks to every supporter — we hit 100%!

jackson-coreutils BigDecimal Amplification DoS (CWE-400) Analysis and Fix

More from this source