{"schema_version":"1.9.0","id":"CVE-2023-3894","published":"2023-08-08T16:59:58.129Z","modified":"2026-08-12T03:51:09.866145741Z","aliases":["GHSA-rg2c-cfxv-qp6f"],"related":["openSUSE-SU-2024:13151-1"],"summary":"DOS in jackson-dataformats-text","details":"Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.\n","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/fasterxml/jackson-dataformats-text","events":[{"introduced":"0"},{"fixed":"d2cd7aaeb357919570db98f361be34334813e865"}],"database_specific":{"cpe":"cpe:2.3:a:fasterxml:jackson-dataformats-text:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.15.0"}],"source":["AFFECTED_FIELD","CPE_RANGE"]}}],"versions":["jackson-dataformats-text-2.15.0-rc3","jackson-dataformats-text-2.15.0-rc2","jackson-dataformats-text-2.15.0-rc1","jackson-dataformats-text-2.14.1","jackson-dataformats-text-2.14.0","jackson-dataformats-text-2.14.0-rc3","jackson-dataformats-text-2.14.0-rc2","jackson-dataformats-text-2.14.0-rc1","jackson-dataformats-text-2.13.0","jackson-dataformats-text-2.13.0-rc2","jackson-dataformats-text-2.13.0-rc1","jackson-dataformats-text-2.12.1","jackson-dataformats-text-2.12.0","jackson-dataformats-text-2.12.0-rc2","jackson-dataformats-text-2.12.0-rc1","jackson-dataformats-text-2.11.0","jackson-dataformats-text-2.11.0.rc1","jackson-dataformats-text-2.10.0","jackson-dataformats-text-2.10.0.pr3","jackson-dataformats-text-2.10.0.pr2","jackson-dataformats-text-2.10.0.pr1","2.9.6-b","jackson-dataformats-text-2.9.6","jackson-dataformats-text-2.9.5","jackson-dataformats-text-2.9.4","jackson-dataformats-text-2.9.3","jackson-dataformats-text-2.9.2","jackson-dataformats-text-2.9.1","jackson-dataformats-text-2.9.0","jackson-dataformats-text-2.9.0.pr4","jackson-dataformats-text-2.9.0.pr3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3894.json"}}],"references":[{"type":"WEB","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50083"},{"type":"WEB","url":"https://github.com/FasterXML/jackson-dataformats-text/blob/2.16/release-notes/VERSION-2.x"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3894.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3894"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-dataformats-text/pull/398"},{"type":"PACKAGE","url":"https://github.com/FasterXML/jackson-dataformats-text"}],"database_specific":{"cna_assigner":"Google","cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3894.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L"}]}