Encyclopedia
Maven⚠ HIGHslopsquat⚠ ACTIVE THREAT

jackson-databind-extra

First seen: Aug 22, 2024 1 viewsMimics: jackson-databind
Share threatHN
Threat Description

Hallucinated 'extra' module for jackson-databind. The artifact re-enables polymorphic deserialization with default typing, reintroducing the historic RCE vector that lets attackers deserialize arbitrary classes from untrusted JSON.

AI Hallucination Analysis
Very Likely AI Hallucination85%
Known to be hallucinated by: ChatGPT-4
Remediation Guide
  1. Remove 'jackson-databind-extra' from your pom.xml immediately.
  2. Replace with the legitimate 'jackson-databind'.
  3. Verify default typing is disabled in your ObjectMapper config.
  4. Audit for deserialization-based RCE vulnerabilities.
Quick Facts
Ecosystem
Maven
Risk Level
HIGH
Type
slopsquat
Status
ACTIVE
Legitimate Package
jackson-databind
Hallucination Confidence
85%
Check My Project
Scan for this package