CVE-2023-3894
DOS in jackson-dataformats-text
Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
DOS in jackson-dataformats-text
Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
- Record
CVE-2023-3894- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2023-2347
Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
- Record
EUVD-2023-2347- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rg2c-cfxv-qp6f
Denial of service in jackson-dataformat-toml
Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
- Record
GHSA-rg2c-cfxv-qp6f- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400, CWE-787
- Updated
- 2026-11-02
NVD
Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
- Record
CVE-2023-3894- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-787
- Updated
- 2026-11-02
OSV
DOS in jackson-dataformats-text
Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
- Record
CVE-2023-3894- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-rg2c-cfxv-qp6f
Denial of service in jackson-dataformat-toml
Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
- Record
GHSA-rg2c-cfxv-qp6f- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400, CWE-787
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13151-1 No score
jackson-dataformat-csv-2.15.2-1.1 on GA media
These are all security issues fixed in the jackson-dataformat-csv-2.15.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13151-1- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2023-3894 No score
CVE-2023-3894 in com.fasterxml.jackson.dataformat:jackson-dataformat-toml - Patched by Root
Root has patched CVE-2023-3894 in the com.fasterxml.jackson.dataformat:jackson-dataformat-toml package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2023-3894- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.fasterxml.jackson.dataformat:jackson-dataformat-tomlMaven |
before 2.15.0 | 2.15.0 |
com.fasterxml.jackson.dataformat:jackson-dataformat-tomlMaven |
before 2.15.0, plus listed versions 2.12.32.12.42.12.52.12.62.12.7 Show 18 moreShow less2.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.32.13.42.13.52.14.02.14.0-rc12.14.0-rc22.14.0-rc32.14.12.14.22.14.32.15.0-rc12.15.0-rc22.15.0-rc3 |
2.15.0 |
com.fasterxml.jackson.dataformat:jackson-dataformat-tomlRoot:Maven |
before 2.13.0-aikido.1 | 2.13.0-aikido.12.12.7-aikido.1 |
io.root.com.fasterxml.jackson.dataformat:jackson-dataformat-tomlRoot:Maven |
before 2.13.0-root.io.1 | 2.13.0-root.io.12.12.7-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-3894 is a medium vulnerability (CVSS 5.8) in Fasterxml Jackson-dataformats-text, published August 8, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in com.fasterxml.jackson.dataformat:jackson-dataformat-toml 2.15.0.
References
bugs.chromium.org/p/oss-fuzz/issues/detail?id=50083
github.com/FasterXML/jackson-dataformats-text/pull/398
nvd.nist.gov/vuln/detail/CVE-2023-3894