Vulnerable Library - flyway-core-9.16.3.jar
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.12.0/commons-lang3-3.12.0.jar
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (flyway-core version) |
Remediation Possible** |
| CVE-2026-54513 |
 High |
8.1 |
jackson-databind-2.15.4.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-54512 |
High |
8.1 |
jackson-databind-2.15.4.jar |
Transitive |
N/A* |
❌ |
| WS-2026-0003 |
High |
7.5 |
jackson-core-2.15.4.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-54515 |
 Medium |
5.3 |
jackson-databind-2.15.4.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-54514 |
Medium |
5.3 |
jackson-databind-2.15.4.jar |
Transitive |
N/A* |
❌ |
| CVE-2025-48924 |
Medium |
5.3 |
commons-lang3-3.12.0.jar |
Transitive |
N/A* |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-54513
Vulnerable Library - jackson-databind-2.15.4.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.15.4/jackson-databind-2.15.4.jar
Dependency Hierarchy:
- flyway-core-9.16.3.jar (Root Library)
- jackson-dataformat-toml-2.15.4.jar
- ❌ jackson-databind-2.15.4.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Publish Date: 2026-06-23
URL: CVE-2026-54513
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-23
Fix Resolution: https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4
Step up your Open Source Security Game with Mend here
CVE-2026-54512
Vulnerable Library - jackson-databind-2.15.4.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.15.4/jackson-databind-2.15.4.jar
Dependency Hierarchy:
- flyway-core-9.16.3.jar (Root Library)
- jackson-dataformat-toml-2.15.4.jar
- ❌ jackson-databind-2.15.4.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Publish Date: 2026-06-23
URL: CVE-2026-54512
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-23
Fix Resolution: https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.8
Step up your Open Source Security Game with Mend here
WS-2026-0003
Vulnerable Library - jackson-core-2.15.4.jar
Core Jackson processing abstractions (aka Streaming API), implementation for JSON
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.15.4/jackson-core-2.15.4.jar
Dependency Hierarchy:
- flyway-core-9.16.3.jar (Root Library)
- jackson-dataformat-toml-2.15.4.jar
- jackson-databind-2.15.4.jar
- ❌ jackson-core-2.15.4.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
The non-blocking (async) JSON parser in jackson-core bypasses the maxNumberLength constraint (default: 1000 characters) defined in StreamReadConstraints. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS).
The standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy.
Publish Date: 2026-03-02
URL: WS-2026-0003
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-72hv-8253-57qq
Release Date: 2026-03-02
Fix Resolution: com.fasterxml.jackson.core:jackson-core:2.18.6,https://github.com/FasterXML/jackson-core.git - jackson-core-2.21.1,https://github.com/FasterXML/jackson-core.git - jackson-core-2.18.6,tools.jackson.core:jackson-core:3.1.0,https://github.com/FasterXML/jackson-core.git - jackson-core-3.1.0
Step up your Open Source Security Game with Mend here
CVE-2026-54515
Vulnerable Library - jackson-databind-2.15.4.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.15.4/jackson-databind-2.15.4.jar
Dependency Hierarchy:
- flyway-core-9.16.3.jar (Root Library)
- jackson-dataformat-toml-2.15.4.jar
- ❌ jackson-databind-2.15.4.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.
Publish Date: 2026-06-23
URL: CVE-2026-54515
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-23
Fix Resolution: https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4
Step up your Open Source Security Game with Mend here
CVE-2026-54514
Vulnerable Library - jackson-databind-2.15.4.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.15.4/jackson-databind-2.15.4.jar
Dependency Hierarchy:
- flyway-core-9.16.3.jar (Root Library)
- jackson-dataformat-toml-2.15.4.jar
- ❌ jackson-databind-2.15.4.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Publish Date: 2026-06-23
URL: CVE-2026-54514
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-23
Fix Resolution: https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.8
Step up your Open Source Security Game with Mend here
CVE-2025-48924
Vulnerable Library - commons-lang3-3.12.0.jar
Apache Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
Library home page: https://www.apache.org/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.12.0/commons-lang3-3.12.0.jar
Dependency Hierarchy:
- flyway-core-9.16.3.jar (Root Library)
- commons-text-1.10.0.jar
- ❌ commons-lang3-3.12.0.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
StackOverflowError could cause an application to stop.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-07-11
URL: CVE-2025-48924
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2025-07-11
Fix Resolution: https://github.com/apache/commons-lang.git - commons-lang-3.18.0,org.apache.commons:commons-lang3:3.18.0
Step up your Open Source Security Game with Mend here
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.12.0/commons-lang3-3.12.0.jar
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - jackson-databind-2.15.4.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.15.4/jackson-databind-2.15.4.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Publish Date: 2026-06-23
URL: CVE-2026-54513
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-23
Fix Resolution: https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4
Step up your Open Source Security Game with Mend here
Vulnerable Library - jackson-databind-2.15.4.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.15.4/jackson-databind-2.15.4.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Publish Date: 2026-06-23
URL: CVE-2026-54512
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-23
Fix Resolution: https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - jackson-core-2.15.4.jar
Core Jackson processing abstractions (aka Streaming API), implementation for JSON
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.15.4/jackson-core-2.15.4.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
The non-blocking (async) JSON parser in jackson-core bypasses the maxNumberLength constraint (default: 1000 characters) defined in StreamReadConstraints. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS).
The standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy.
Publish Date: 2026-03-02
URL: WS-2026-0003
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-72hv-8253-57qq
Release Date: 2026-03-02
Fix Resolution: com.fasterxml.jackson.core:jackson-core:2.18.6,https://github.com/FasterXML/jackson-core.git - jackson-core-2.21.1,https://github.com/FasterXML/jackson-core.git - jackson-core-2.18.6,tools.jackson.core:jackson-core:3.1.0,https://github.com/FasterXML/jackson-core.git - jackson-core-3.1.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - jackson-databind-2.15.4.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.15.4/jackson-databind-2.15.4.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.
Publish Date: 2026-06-23
URL: CVE-2026-54515
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-23
Fix Resolution: https://github.com/FasterXML/jackson-databind.git - jackson-databind-3.1.4
Step up your Open Source Security Game with Mend here
Vulnerable Library - jackson-databind-2.15.4.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://fasterxml.com/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.15.4/jackson-databind-2.15.4.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Publish Date: 2026-06-23
URL: CVE-2026-54514
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-23
Fix Resolution: https://github.com/FasterXML/jackson-databind.git - jackson-databind-2.18.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - commons-lang3-3.12.0.jar
Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Library home page: https://www.apache.org/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-lang3/3.12.0/commons-lang3-3.12.0.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
StackOverflowError could cause an application to stop.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-07-11
URL: CVE-2025-48924
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2025-07-11
Fix Resolution: https://github.com/apache/commons-lang.git - commons-lang-3.18.0,org.apache.commons:commons-lang3:3.18.0
Step up your Open Source Security Game with Mend here