Skip to content
Threat Feed
Subscribe

Tag

Serialization

3 briefs RSS
medium advisory

Jackson-core Async Parser Max Number Length Bypass via Chunked Digit Accumulation

An incomplete fix for GHSA-72hv-8253-57qq in `jackson-core` versions 2.18.6, 2.21.1, and potentially 3.0.x/3.1.x, allows attackers to bypass `maxNumberLength` constraints in the non-blocking JSON parser by streaming JSON numbers in small chunks, leading to unbounded memory accumulation and denial of service in reactive applications.

jackson-core +3 java json serialization memory-exhaustion denial-of-service
1t
high advisory

Improper Validation Vulnerability in fraillt bitsery (CVE-2026-9521)

A remote code execution vulnerability exists in fraillt bitsery versions up to 5.2.4 due to improper validation of input in the `loadFromSharedState` function, potentially leading to arbitrary code execution.

bitsery cve rce serialization
2r 1c
high advisory

Metabase Enterprise Remote Code Execution via Serialization Import

Authenticated administrators in vulnerable Metabase Enterprise editions can achieve Remote Code Execution (RCE) and Arbitrary File Read by injecting an `INIT` property into the H2 JDBC spec via a crafted serialization archive through the `POST /api/ee/serialization/import` endpoint.

Metabase Enterprise metabase rce serialization cve-2026-33725
2r 1t