CVE-2025-52999
HighAdvisory
Published 27 Jun 2025In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- 0.007
- 50th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 540
- of 17,787 indexed, latest versions
- Container images
- 516
- deployed by those charts
- Fix available
- 1 of 1
- affected package
jackson-core can throw a StackoverflowError when processing deeply nested data
Carried by container images the latest versions of 540 of 17,787 indexed charts deploy, on 516 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jackson-coremaven | 2.0.5, 2.2.3, 2.3.0, 2.3.3+55 more | 2.15.0 | 516 |
- OSV records
- GHSA-h46c-h94j-95f3
Charts affected
540 by stars
Container images carrying it
516 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| seataio/ | 703b5de7f1a6 | jackson-core | 2.15.0 | 1 |
| seataio/ | ee1ed55f4144 | jackson-core | 2.15.0 | 1 |
| seldonio/ | ba81b17f00eb | jackson-core | 2.15.0 | 1 |
| seldonio/ | eea0d3f578ca | jackson-core | 2.15.0 | 1 |
| seldonio/ | 29e362bb1ba2 | jackson-core | 2.15.0 | 1 |
| signald/ | 0ffad7ccc2eb | jackson-core | 2.15.0 | 1 |
| signald/ | edbff058278c | jackson-core | 2.15.0 | 1 |
| slagattollas/ | cecd95e31486 | jackson-core | 2.15.0 | 1 |
| slagattollas/ | dc63973dae0d | jackson-core | 2.15.0 | 1 |
| slamdev/ | b4b029c9b15f | jackson-core | 2.15.0 | 1 |
| slamdev/ | 3ca20c184c55 | jackson-core | 2.15.0 | 1 |
| snappydatainc/ | fd4b2070466f | jackson-core | 2.15.0 | 1 |
| snowplow/ | 5a38033f07c1 | jackson-core | 2.15.0 | 1 |
| snowplow/ | 41d318841516 | jackson-core | 2.15.0 | 1 |
| someblackmagic/ | 0d63ba37a560 | jackson-core | 2.15.0 | 1 |
| sonatype/ | 586060431b64 | jackson-core | 2.15.0 | 1 |
| sslhep/ | 9e80af083079 | jackson-core | 2.15.0 | 1 |
| stanislovesid/ | 4fe1ed26e194 | jackson-core | 2.15.0 | 1 |
| thehiveproject/ | f4bc64fb8844 | jackson-core | 2.15.0 | 1 |
| thelastpickle/ | 9c53996c457d | jackson-core | 2.15.0 | 1 |
| thingsboard/ | bd45a09d85d9 | jackson-core | 2.15.0 | 1 |
| thingsboard/ | a06f53c5e2da | jackson-core | 2.15.0 | 1 |
| thingsboard/ | 030f316ce301 | jackson-core | 2.15.0 | 1 |
| thingsboard/ | 645f43b688f7 | jackson-core | 2.15.0 | 1 |
| thingsboard/ | f40a542832c4 | jackson-core | 2.15.0 | 1 |
| thmmniii/ | 5438517d9fc2 | jackson-core | 2.15.0 | 1 |
| thmmniii/ | 86105349c1a3 | jackson-core | 2.15.0 | 1 |
| torrespro/ | 6d3bd305a1ba | jackson-core | 2.15.0 | 1 |
| trinodb/ | 38c6f24ab1a4 | jackson-core | 2.15.0 | 1 |
| trinodb/ | ee80ab5eeab2 | jackson-core | 2.15.0 | 1 |
| vientoprojects/ | eb2a71531741 | jackson-core | 2.15.0 | 1 |
| viniciusfcf/ | bba8ee1b5cd5 | jackson-core | 2.15.0 | 1 |
| vlebediantsev/ | e7f20450d2ae | jackson-core | 2.15.0 | 1 |
| vlebediantsev/ | 10393a89b4a8 | jackson-core | 2.15.0 | 1 |
| vlebediantsev/ | df8bf38c535b | jackson-core | 2.15.0 | 1 |
| vlebediantsev/ | 427af418b75e | jackson-core | 2.15.0 | 1 |
| vlebediantsev/ | 9319437f3c8f | jackson-core | 2.15.0 | 1 |
| voltha/ | e038acb950d3 | jackson-core | 2.15.0 | 1 |
| vrijbrp/ | 5c770c2ae48c | jackson-core | 2.15.0 | 1 |
| wavefronthq/ | d1064d28f6eb | jackson-core | 2.15.0 | 1 |
| wistefan/ | e0887302b2d8 | jackson-core | 2.15.0 | 1 |
| woojoong/ | ec230db19652 | jackson-core | 2.15.0 | 1 |
| xeotek/ | 4c6b04d9ce55 | jackson-core | 2.15.0 | 1 |
| xetusoss/ | 88f25242b9ee | jackson-core | 2.15.0 | 1 |
| xuxueli/ | 640093c35fd6 | jackson-core | 2.15.0 | 1 |
| yuzutech/ | 192b7b27c857 | jackson-core | 2.15.0 | 1 |
| zahoriaut/ | b2de13916f3e | jackson-core | 2.15.0 | 1 |
| zammad/ | 8274d75a51fc | jackson-core | 2.15.0 | 1 |
| zbalogh/ | 7c247e399a1f | jackson-core | 2.15.0 | 1 |
| zenko/ | 386a1f48ec0e | jackson-core | 2.15.0 | 1 |