False positive reported on Jackson Core CVE-2025-52999

Open
#447 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
java
Domain
security

Research direction

Start by reproducing an Xray scan for com.fasterxml.jackson.core:jackson-core:2.21.3 and compare the result with the NVD entry for CVE-2025-52999. The work is done when versions at or above 2.15.0 are no longer reported as affected; the issue names no repository files or tests to inspect.

Written by the indexing model from the issue text.

Description

Describe the bug
Xray reports CVE-2025-52999 against com.fasterxml.jackson.core:jackson-core. This CVE affects versions < 2.15.0. Our installed version is 2.21.3, which is far above the fix threshold.

To Reproduce
Xray scan a software containing jackson-core 2.21.3 and see CVE-2025-52999 reported. This CVE impacts jackson-core < 2.15.0 only.

Expected behavior
CVE-2025-52999 should not be reported for jackson-core >= 2.15.0.

Versions

  • Package: com.fasterxml.jackson.core:jackson-core:2.21.3
  • Vulnerable range per NVD: < 2.15.0
  • Fix version: 2.15.0

Additional context
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-52999

Dominant language
Java
Stars
331
Forks
163
Avg merge
20h 9m
Merged PRs (30d)
1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from jfrog/artifactory-client-java

All issues in jfrog/artifactory-client-java

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.