CVE-2018-1000873
Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
- Record
CVE-2018-1000873- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
- Record
CVE-2018-1000873- Updated
- 2026-11-02
EUVDEUVD-2018-0811 No score
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
- Record
EUVD-2018-0811- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h4x4-5qp2-wp46
Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Databind that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
- Record
GHSA-h4x4-5qp2-wp46- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
- Record
CVE-2018-1000873- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-h4x4-5qp2-wp46
Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Databind that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
- Record
GHSA-h4x4-5qp2-wp46- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVRHLW-2026-7b68982493d0dce4
Lightwell Security Advisory: jackson-datatype-jsr310 2.8.11.rhlw-00001
Red Hat Lightwell has released com.fasterxml.jackson.datatype:jackson-datatype-jsr310 2.8.11.rhlw-00001 with a backported security fix.
CVE-2018-1000873: Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
This patched artifact is a drop-in replacement for com.fasterxml.jackson.datatype:jackson-datatype-jsr310 2.8.11 from Maven Central.
- Record
RHLW-2026-7b68982493d0dce4- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1000873
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
- Record
UBUNTU-CVE-2018-1000873- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.fasterxml.jackson.datatype:jackson-datatype-jsr310Maven |
before 2.9.8 | 2.9.8 |
com.fasterxml.jackson.datatype:jackson-datatype-jsr310Maven |
before 2.9.8, plus listed versions 2.2.0-beta12.2.1-beta22.2.2-beta32.2.2-beta42.2.3-beta5 Show 45 moreShow less2.3.0-beta62.3.0-beta72.3.0-rc12.3.12.3.22.3.32.3.42.3.52.4.02.4.0-rc22.4.0-rc32.4.12.4.22.4.32.4.42.4.52.4.62.5.02.5.0-rc12.5.12.5.22.5.32.5.42.5.52.6.02.6.0-rc12.6.0-rc22.6.0-rc32.6.0-rc42.6.12.6.22.6.32.6.42.6.52.6.62.6.72.7.02.7.0-rc12.7.0-rc22.7.0-rc32.7.12.7.22.7.32.7.42.7.5 |
2.9.8 |
com.fasterxml.jackson.datatype:jackson-datatype-jsr310Red Hat Lightwell:Maven |
before 2.8.11.rhlw-00001, plus listed versions 2.2.0-beta12.2.1-beta22.2.2-beta32.2.2-beta42.2.3-beta5 Show 45 moreShow less2.3.0-beta62.3.0-beta72.3.0-rc12.3.12.3.22.3.32.3.42.3.52.4.02.4.0-rc22.4.0-rc32.4.12.4.22.4.32.4.42.4.52.4.62.5.02.5.0-rc12.5.12.5.22.5.32.5.42.5.52.6.02.6.0-rc12.6.0-rc22.6.0-rc32.6.0-rc42.6.12.6.22.6.32.6.42.6.52.6.62.6.72.7.02.7.0-rc12.7.0-rc22.7.0-rc32.7.12.7.22.7.32.7.42.7.5 |
2.8.11.rhlw-00001 |
jackson-databindUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.2.2-12.2.2-1ubuntu0.1~esm1 |
None known |
jackson-databindUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.4.2-22.4.2-32.4.2-3ubuntu0.1~esm12.4.2-3ubuntu0.1~esm2 |
None known |
jackson-databindUbuntu:18.04:LTS |
All versions, plus listed versions 2.8.6-12.9.1-12.9.4-12.9.5-12.9.8-1~18.04 |
None known |
jackson-databindUbuntu:20.04:LTS |
All versions, plus listed versions 2.9.9.3-12.10.0-22.10.1-12.10.2-1 |
None known |
jackson-databindUbuntu:22.04:LTS |
All versions, plus listed versions 2.12.1-12.12.5-12.13.0-12.13.0-2 |
None known |
jackson-databindUbuntu:24.04:LTS |
All versions, plus listed versions 2.14.0-1 |
None known |
jackson-databindUbuntu:25.10 |
All versions, plus listed versions 2.14.0+ds-1 |
None known |
jackson-databindUbuntu:26.10 |
All versions, plus listed versions 2.14.0+ds-1build12.14.0+ds-2 |
None known |
jackson-databindUbuntu:26.04:LTS |
All versions, plus listed versions 2.14.0+ds-12.14.0+ds-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000873 is a medium vulnerability (CVSS 6.5) in Fasterxml Jackson-modules-java8, published December 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.76%, the 91st percentile. Fixed in com.fasterxml.jackson.datatype:jackson-datatype-jsr310 2.9.8.
References
lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
Show 19 moreShow less
oracle.com/security-alerts/cpuapr2020.html
github.com/FasterXML/jackson-modules-java8/pull/87
bugzilla.redhat.com/show_bug.cgi?id=1665601
security.netapp.com/advisory/ntap-20200904-0004
nvd.nist.gov/vuln/detail/CVE-2018-1000873
ubuntu.com/security/CVE-2018-1000873
cve.org/CVERecord?id=CVE-2018-1000873
Left out here: 48 versions. The JSON record has them.