Skip to content

Conversation

@aikido-autofix
Copy link

Targeted updates to remediate security findings while preserving existing behavior

Upgraded jackson-core, guava, commons-io, and rhino to address critical security vulnerabilities including potential RCE, DoS, and resource consumption risks.

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2025-52999
HIGH
A stack overflow vulnerability in Jackson JSON parser allows deep JSON nesting to cause application crashes via resource exhaustion, potentially enabling denial of service attacks on parsing untrusted input.
CVE-2023-2976
HIGH
Guava's FileBackedOutputStream creates temporary files in a shared directory, potentially exposing sensitive data to other local users and applications on Unix/Android systems through unauthorized file access.
CVE-2020-8908
LOW
Temp directory creation flaw in Guava allows unauthorized access to world-readable temp directories, potentially exposing sensitive data to local attackers on unix-like systems.
CVE-2024-47554
LOW
Uncontrolled resource consumption vulnerability in XmlStreamReader allows attackers to craft malicious input that can trigger excessive CPU usage, potentially causing a denial of service (DoS) condition.
CVE-2025-66453
LOW
Rhino JavaScript implementation vulnerable to DoS via toFixed() function, where attacker-controlled float inputs can trigger excessive CPU consumption by causing extreme power calculations in internal conversion methods.
🔗 Related Tasks

@aikido-autofix aikido-autofix bot added the Kroo Label created by Aikido AutoFix label Jan 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Kroo Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant