GHSA-q95j-488q-5q3p
Apiman Manager API affected by Jackson denial of service vulnerability
Impact
Due to a vulnerability in jackson-databind <= 2.12.6.0, an authenticated attacker could craft an Apiman policy configuration which, when saved, may cause a denial of service on the Apiman Manager API.
This does not affect the Apiman Gateway.
Patches
Upgrade to Apiman 3.0.0.Final or later.
If you are using an older version of Apiman and need to remain on that version, contact your Apiman support provider for advice/long-term support.
Workarounds
If all users of the Apiman Manager are trusted then you may assess this is low risk, as an account is required to exploit the vulnerability.
References
- Apiman maintainer and security contact: marc@blackparrotlabs.io
- https://nvd.nist.gov/vuln/detail/CVE-2020-36518
- https://github.com/FasterXML/jackson-databind/issues/2816
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score used
Apiman Manager API affected by Jackson denial of service vulnerability
Impact
Due to a vulnerability in jackson-databind <= 2.12.6.0, an authenticated attacker could craft an Apiman policy configuration which, when saved, may cause a denial of service on the Apiman Manager API.
This does not affect the Apiman Gateway.
Patches
Upgrade to Apiman 3.0.0.Final or later.
If you are using an older version of Apiman and need to remain on that version, contact your Apiman support provider for advice/long-term support.
Workarounds
If all users of the Apiman Manager are trusted then you may assess this is low risk, as an account is required to exploit the vulnerability.
References
- Apiman maintainer and security contact: marc@blackparrotlabs.io
- https://nvd.nist.gov/vuln/detail/CVE-2020-36518
- https://github.com/FasterXML/jackson-databind/issues/2816
- Record
GHSA-q95j-488q-5q3p- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Apiman Manager API affected by Jackson denial of service vulnerability
Impact
Due to a vulnerability in jackson-databind <= 2.12.6.0, an authenticated attacker could craft an Apiman policy configuration which, when saved, may cause a denial of service on the Apiman Manager API.
This does not affect the Apiman Gateway.
Patches
Upgrade to Apiman 3.0.0.Final or later.
If you are using an older version of Apiman and need to remain on that version, contact your Apiman support provider for advice/long-term support.
Workarounds
If all users of the Apiman Manager are trusted then you may assess this is low risk, as an account is required to exploit the vulnerability.
References
- Apiman maintainer and security contact: marc@blackparrotlabs.io
- https://nvd.nist.gov/vuln/detail/CVE-2020-36518
- https://github.com/FasterXML/jackson-databind/issues/2816
- Record
GHSA-q95j-488q-5q3p- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.apiman:apiman-manager-api-implMaven | through 2.2.3.Final | 3.0.0.Final |
io.apiman:apiman-manager-api-implMaven | before 3.0.0.Final | 3.0.0.Final |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-q95j-488q-5q3p is a medium vulnerability (CVSS 6.5) in io.apiman:apiman-manager-api-impl, published January 9, 2023. No source lists public exploit code. Fixed in io.apiman:apiman-manager-api-impl 3.0.0.Final.