jfrog / jfrog/artifactory-client-java

False positive reported on Jackson Core CVE-2025-52999

Open
#447 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
331
Forks
163
Avg merge
20h 9m
Merged PRs (30d)
1

Description

Describe the bug
Xray reports CVE-2025-52999 against com.fasterxml.jackson.core:jackson-core. This CVE affects versions < 2.15.0. Our installed version is 2.21.3, which is far above the fix threshold.

To Reproduce
Xray scan a software containing jackson-core 2.21.3 and see CVE-2025-52999 reported. This CVE impacts jackson-core < 2.15.0 only.

Expected behavior
CVE-2025-52999 should not be reported for jackson-core >= 2.15.0.

Versions

  • Package: com.fasterxml.jackson.core:jackson-core:2.21.3
  • Vulnerable range per NVD: < 2.15.0
  • Fix version: 2.15.0

Additional context
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-52999

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing an Xray scan for com.fasterxml.jackson.core:jackson-core:2.21.3 and compare the result with the NVD entry for CVE-2025-52999. The work is done when versions at or above 2.15.0 are no longer reported as affected; the issue names no repository files or tests to inspect.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.