CVE-2025-52999
HighAdvisory
Published 27 Jun 2025In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- 0.007
- 50th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 541
- of 17,781 indexed, latest versions
- Container images
- 517
- deployed by those charts
- Fix available
- 1 of 1
- affected package
jackson-core can throw a StackoverflowError when processing deeply nested data
Carried by container images the latest versions of 541 of 17,781 indexed charts deploy, on 517 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jackson-coremaven | 2.0.5, 2.2.3, 2.3.0, 2.3.3+55 more | 2.15.0 | 517 |
- OSV records
- GHSA-h46c-h94j-95f3
Charts affected
541 by stars
Container images carrying it
517 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| bitnamilegacy/ | cb04e49e6eb1 | jackson-core | 2.15.0 | 1 |
| bitnamilegacy/ | dba59d740e13 | jackson-core | 2.15.0 | 1 |
| bivas/ | 05545994f806 | jackson-core | 2.15.0 | 1 |
| chandanteekinavar/ | 0cf52bf5ee9a | jackson-core | 2.15.0 | 1 |
| choerodon/ | 3c94c97f6f69 | jackson-core | 2.15.0 | 1 |
| ckan/ | ef8e5d3e6be1 | jackson-core | 2.15.0 | 1 |
| cmosborn/ | 6ec0a8878ad2 | jackson-core | 2.15.0 | 1 |
| cnieg/ | d4b478d76f2a | jackson-core | 2.15.0 | 1 |
| codetogether/ | 4348c8a38752 | jackson-core | 2.15.0 | 1 |
| commerceexperts/ | 9e33ad89baf6 | jackson-core | 2.15.0 | 1 |
| confluentinc/ | f2975d507a2a | jackson-core | 2.15.0 | 1 |
| confluentinc/ | 8f1544df1f48 | jackson-core | 2.15.0 | 1 |
| confluentinc/ | 1bbda887bc53 | jackson-core | 2.15.0 | 1 |
| confluentinc/ | 3bf359d5e340 | jackson-core | 2.15.0 | 1 |
| confluentinc/ | 83dbca3efd2a | jackson-core | 2.15.0 | 1 |
| confluentinc/ | c0224a1adf7a | jackson-core | 2.15.0 | 1 |
| confluentinc/ | c87b1c07fb53 | jackson-core | 2.15.0 | 1 |
| confluentinc/ | dc9b972db002 | jackson-core | 2.15.0 | 1 |
| confluentinc/ | 4bc70a83ca6f | jackson-core | 2.15.0 | 1 |
| confluentinc/ | b0b7aa26254a | jackson-core | 2.15.0 | 1 |
| confluentinc/ | 8ec46c27982f | jackson-core | 2.15.0 | 1 |
| confluentinc/ | ee403d5b9090 | jackson-core | 2.15.0 | 1 |
| confluentinc/ | b651d4b6185a | jackson-core | 2.15.0 | 1 |
| confluentinc/ | 0bec03c1f3ce | jackson-core | 2.15.0 | 1 |
| confluentinc/ | 78c190f4472c | jackson-core | 2.15.0 | 1 |
| craigwillis/ | ae317d7e4724 | jackson-core | 2.15.0 | 1 |
| dannielkil/ | e3b479a55a69 | jackson-core | 2.15.0 | 1 |
| datappeal/ | e38c085a3567 | jackson-core | 2.15.0 | 1 |
| davidvmar/ | 0d221e834a21 | jackson-core | 2.15.0 | 1 |
| dbanda/ | 0ca125e68e53 | jackson-core | 2.15.0 | 1 |
| dbanda/ | d0e6367876ae | jackson-core | 2.15.0 | 1 |
| dellcloud/ | 02fc234353a9 | jackson-core | 2.15.0 | 1 |
| dellcloud/ | 4d2eb25b9225 | jackson-core | 2.15.0 | 1 |
| deltaio/ | 8b75118187c5 | jackson-core | 2.15.0 | 1 |
| dniel/ | 45a667852f2a | jackson-core | 2.15.0 | 1 |
| dniel/ | f67129ea1c64 | jackson-core | 2.15.0 | 1 |
| dremio/ | 80ed2e3b7c43 | jackson-core | 2.15.0 | 1 |
| drpcorg/ | 8858fae1859d | jackson-core | 2.15.0 | 1 |
| duck1123/ | 0e29f19fa67c | jackson-core | 2.15.0 | 1 |
| duck1123/ | 9568c5961d5d | jackson-core | 2.15.0 | 1 |
| duck1123/ | 9d6fb247b714 | jackson-core | 2.15.0 | 1 |
| duck1123/ | 119fc5d4cbfb | jackson-core | 2.15.0 | 1 |
| easypi/ | d2950a36a576 | jackson-core | 2.15.0 | 1 |
| egdsandaru/ | 681baa1926f4 | jackson-core | 2.15.0 | 1 |
| elastictranscoder/ | 963ab3858c6b | jackson-core | 2.15.0 | 1 |
| elastictranscoder/ | 26208b8c2359 | jackson-core | 2.15.0 | 1 |
| elastictranscoder/ | b4a0327029e6 | jackson-core | 2.15.0 | 1 |
| elastictranscoder/ | 5b75d19e2733 | jackson-core | 2.15.0 | 1 |
| emeraldpay/ | 126f0ae0b388 | jackson-core | 2.15.0 | 1 |
| emeraldpay/ | ac2a4bc66ab6 | jackson-core | 2.15.0 | 1 |