Description
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jettison | Jettison | unspecified – ≤ 1.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libjettison-java | 1.5.3-1 | — |
| Debian 13 | libjettison-java | 1.5.3-1 | — |
| Debian 12 | libjettison-java | 1.5.3-1 | — |
| Debian 11 | libjettison-java | 1.5.3-1~deb11u1 | DSA-5312-1 |
| Debian 10 | libjettison-java | 1.5.3-1~deb10u1 | DLA-3259-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libjettison-java | No fix yet | — |
| Ubuntu 26.04 LTS | libjettison-java | No fix yet | — |
| Ubuntu 25.10 | libjettison-java | No fix yet | — |
| Ubuntu 24.04 LTS | libjettison-java | No fix yet | — |
| Ubuntu 22.04 LTS | libjettison-java | 1.4.1-1ubuntu0.22.04.1 | USN-6177-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libjettison-java | 1.4.0-1ubuntu0.20.04.1 | USN-6177-1 |
| Ubuntu Pro 18.04 LTS | libjettison-java | 1.4.0-1ubuntu0.18.04.1~esm1 | USN-6177-1 |
| Ubuntu Pro 16.04 LTS | libjettison-java | 1.2-3ubuntu0.1~esm1 | USN-6177-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.6-1.redhat_00001.1.el7sso | RHSA-2023:1045, RHSA-2023:1044, RHSA-2023:1043 |
| Red Hat Ocp Tools 4 | jenkins | 2.401.1.1686649641-3.el8 | RHSA-2023:3663, RHSA-2023:3610 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.11.1686831822-1.el8 | RHSA-2023:3663, RHSA-2023:3610 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-activemq-artemis +15 | 2.9.0-10.redhat_00021.1.el7eap | RHSA-2025:4437 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-gson | 2.8.9-1.redhat_00001.1.el7eap | RHSA-2025:4437 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hal-console | 3.2.18-1.Final_redhat_00001.1.el7eap | RHSA-2025:4437 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-server-migration +21 | 1.7.2-14.Final_redhat_00015.1.el7eap | RHSA-2025:4437 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.7.14-3.Final_redhat_00001.1.el7eap | RHSA-2025:4437 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +4 | 7.3.13-4.GA_redhat_00002.1.el7eap | RHSA-2025:4437 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-woodstox-core | 6.4.0-1.redhat_00001.1.el7eap | RHSA-2025:4437 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-apache-sshd | 2.9.2-1.redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.9.3-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.16-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-hibernate-search +5 | 5.10.13-3.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.10-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +10 | 2.12.7-1.redhat_00003.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-javaee-security-soteria +1 | 1.0.1-3.redhat_00003.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.49-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 3.0.0-6.SP07_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsp-api_2.3_spec | 2.0.0-3.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.27-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-24.Final_redhat_00023.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jettison | 1.5.2-1.redhat_00002.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.22-1.SP3_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.9-4.GA_redhat_00003.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.16-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-woodstox-core | 6.4.0-1.redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | jettison | 1.5.1-1.1 | openSUSE-SU-2024:12388-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | jettison +1 | 1.3.3-4.amzn2.0.3 | ALAS2-2023-2086 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | 34.0.0-r6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.codehaus.jettison:jettison | < 1.5.2 | 1.5.2 | GHSA-x27m-9w8j-5vcw |
Advisories 26
- RHSA-2025:4437 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.13 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2023:3663 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1045 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1044 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1043 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0554 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0553 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0552 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2023-0239 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2026
- RHSA-2023:3610 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- WID-SEC-2026-2899 Oracle Supply Chain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 18, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2023-1142 Red Hat Integration Camel for Spring Boot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-6177-1 libjettison-java vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-5312-1 libjettison-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3259-1 libjettison-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:12388-1 jettison-1.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0209 Red Hat Integration Camel Extensions for Quarkus: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Sep 21, 2025
- WID-SEC-2023-0138 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- NCSC-2025-0028 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jan 22, 2025
- WID-SEC-2024-0671 Atlassian Jira Software: Mehrere Schwachstellen ermöglichen Codeausführung und DoS BSI CERT-Bund (WID) · Nov 24, 2024
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
- ALAS2-2023-2086 Important: jettison security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 1, 2024
- WID-SEC-2023-1784 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1782 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-0132 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 1, 2023