CVE-2023-35116: Fasterxml Jackson-Databind

Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days.

jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.

Affected products

• Fasterxml Jackson-Databind: before 2.16.0 (fixed in 2.16.0)

Published 2023-06-14. Last modified 2026-06-17.