{"id":"CVE-2023-3894","aliases":["EUVD-2023-2347","GHSA-rg2c-cfxv-qp6f","ROOT-APP-MAVEN-CVE-2023-3894","openSUSE-SU-2024:13151-1"],"status":"published","title":"DOS in jackson-dataformats-text","description":"Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00914,"percentile":0.60415,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-400","CWE-787"],"published":"2023-08-08T16:59:58Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.dataformat:jackson-dataformat-toml","fixed_in":["2.15.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"com.fasterxml.jackson.dataformat:jackson-dataformat-toml","fixed_in":["2.13.0-aikido.1","2.12.7-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.dataformat:jackson-dataformat-toml","fixed_in":["2.13.0-root.io.1","2.12.7-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.dataformat:jackson-dataformat-toml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.dataformat:jackson-dataformat-toml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0"}]}],"versions":["2.12.3","2.12.4","2.12.5","2.12.6","2.12.7","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.3","2.13.4","2.13.5","2.14.0","2.14.0-rc1","2.14.0-rc2","2.14.0-rc3","2.14.1","2.14.2","2.14.3","2.15.0-rc1","2.15.0-rc2","2.15.0-rc3"]},{"source":"osv","ecosystem":"Root:Maven","package":"com.fasterxml.jackson.dataformat:jackson-dataformat-toml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-aikido.1"},{"fixed":"2.12.7-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.dataformat:jackson-dataformat-toml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-root.io.1"},{"fixed":"2.12.7-root.io.1"}]}]}],"products":[{"vendor":"fasterxml","product":"jackson-dataformats-text"}],"references":[{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50083","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","web"]},{"url":"https://github.com/FasterXML/jackson-dataformats-text/pull/398","tags":["x_transferred","Patch","fix","web"]},{"url":"https://github.com/FasterXML/jackson-dataformats-text/blob/2.16/release-notes/VERSION-2.x","tags":["x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3894","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-dataformats-text/commit/5dd5f740aedcf37adad7ffece460e75e54abb0ed","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rg2c-cfxv-qp6f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3894.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-dataformats-text","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3894","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-3894","title":"DOS in jackson-dataformats-text","description":"Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.\n","status":"published","published":"2023-08-08T16:59:58.129Z","modified":"2024-09-27T16:07:38.896Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:24.707957Z"}],"euvd":[{"id":"EUVD-2023-2347","description":"Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.\n","status":"published","published":"2023-08-08T16:59:58Z","modified":"2024-09-27T16:07:38Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:28:05.828156Z"}],"ghsa":[{"id":"GHSA-rg2c-cfxv-qp6f","title":"Denial of service in jackson-dataformat-toml","description":"Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.","status":"published","published":"2023-08-08T18:30:37Z","modified":"2025-10-10T17:37:58Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-400","CWE-787"],"updated_at":"2026-11-02T14:39:00.807341Z"}],"nvd":[{"id":"CVE-2023-3894","description":"Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.\n","status":"published","published":"2023-08-08T18:15:24.297Z","modified":"2026-06-17T06:15:15.737Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-787"],"updated_at":"2026-11-02T14:08:22.812138Z"}],"osv":[{"id":"CVE-2023-3894","title":"DOS in jackson-dataformats-text","description":"Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.\n","status":"published","published":"2023-08-08T16:59:58.129Z","modified":"2026-10-28T02:30:56.396640507Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"GHSA-rg2c-cfxv-qp6f","title":"Denial of service in jackson-dataformat-toml","description":"Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.","status":"published","published":"2023-08-08T18:30:37Z","modified":"2025-10-10T18:05:08.744809Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-400","CWE-787"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"openSUSE-SU-2024:13151-1","title":"jackson-dataformat-csv-2.15.2-1.1 on GA media","description":"These are all security issues fixed in the jackson-dataformat-csv-2.15.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:02:27.463247Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"ROOT-APP-MAVEN-CVE-2023-3894","title":"CVE-2023-3894 in com.fasterxml.jackson.dataformat:jackson-dataformat-toml - Patched by Root","description":"Root has patched CVE-2023-3894 in the com.fasterxml.jackson.dataformat:jackson-dataformat-toml package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-18T02:03:58Z","modified":"2026-09-18T03:15:02.935241673Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}