Debian Jackson-Core Vulnerability Poses DoS Risk

A critical vulnerability in the Jackson-Core library has been identified, affecting multiple Debian distributions. The vulnerability, associated with CVE-2025, allows for potential Denial of Service (DoS) attacks. Affected packages include jackson-databind and jackson-dataformat-smile, which require upgrades to mitigate build failures. For Debian 11 (Bullseye), the fix is available in version 2.14.1-2~deb11u1, while Debian 12 (Bookworm) and Debian 13 (Trixie) have their respective fixes in versions 2.14.1-2~deb12u1 and 2.14.1-2~deb13u1. Users are strongly advised to upgrade their jackson-core packages to ensure system security. The vulnerability was highlighted in a recent advisory, emphasizing the urgency of the situation.

Key Points: • A critical DoS vulnerability in Jackson-Core affects multiple Debian distributions. • Users must upgrade to specific versions to mitigate the risk of exploitation. • The vulnerability is tracked under CVE-2025, with fixes available for Bullseye, Bookworm, and Trixie.