Security Exception in json2avro Package: Vulnerability in Jackson Deserialization
Summary
OSV-2025-638: Security exception in com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla.deser. Affects json2avro across 2 version ranges.
>= 2973d1546d9e4590f54a029db483d6d8abde808d, < ad871e8a497003a90da1ff523b18d96e4afbf5c7
>= d92a3390a6213b1caf4b11e26f923bd6501ffb92
Fixed in ad871e8a497003a90da1ff523b18d96e4afbf5c7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The json2avro package is an open-source tool designed to convert JSON data into Avro format, which is widely used for data serialization in big data applications. This package leverages the Jackson library for JSON parsing and deserialization. The vulnerability arises from a security exception in the Jackson deserialization process, specifically in the UntypedObjectDeserializer class, which could lead to unexpected behavior or crashes when processing certain JSON inputs.
Vulnerability Detail
The vulnerability is a security exception that occurs during the deserialization process in the Jackson library, specifically within the UntypedObjectDeserializer's mapOb method. This issue can be exploited by providing specially crafted JSON input, potentially leading to application crashes or unexpected behavior. The vulnerability was reported through OSS-Fuzz, indicating that it poses a risk in scenarios where untrusted JSON data is processed. The affected versions of json2avro are those introduced before the commit ad871e8a497003a90da1ff523b18d96e4afbf5c7.
How To Fix
Minimum fixed version
ad871e8a497003a90da1ff523b18d96e4afbf5c7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider implementing input validation to sanitize JSON data before processing it with json2avro. This can help mitigate the risk of crashes due to malformed JSON inputs.
Conclusion
The json2avro package has a vulnerability related to the Jackson deserialization process, which can lead to security exceptions and application crashes. It is crucial to update to the patched version to mitigate these risks. Additionally, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for json2avro →
FAQ
json2avro is an open-source tool that converts JSON data into Avro format, facilitating data serialization for big data applications.
The vulnerability is a security exception that occurs during the deserialization process in the Jackson library, which can lead to application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement input validation to sanitize JSON data before processing it with json2avro to mitigate the risk of crashes.
More information can be found in the OSS-Fuzz report at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=438873397.
