Information Disclosure Flaw in Jackson-core Parser for Data Processing by FasterXML

CVE-2025-49128

What is CVE-2025-49128?

A vulnerability exists in the JsonLocation._appendSourceDesc method of Jackson-core, affecting versions 2.0.0 through 2.12.0. When an application processes JSON data from a byte array, the parser mistakenly extracts memory information from the wrong location in the array, leading to the unintentional inclusion of up to 500 bytes of sensitive memory content in error messages. This flaw can result in information disclosure on systems that utilize pooled or reused memory buffers, such as those powered by Netty or Vert.x. Users are advised to upgrade to version 2.13.0 or later to resolve this issue. Alternatively, mitigation strategies such as disabling the exposure of exception messages or source content in errors can help shield sensitive information from being returned in HTTP responses.

References