jsonschema2pojo-core-1.2.1.jar: 4 vulnerabilities (highest severity is: 7.5)

[mend-bolt-for-github]

Vulnerable Library - jsonschema2pojo-core-1.2.1.jar

Library home page: https://github.com/joelittlejohn/jsonschema2pojo

Path to dependency file: /bamboo-generator/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jsonschema2pojo/jsonschema2pojo-core/1.2.1/3f29cfd51d988a5f4c3c2da8fe612cc2242e35/jsonschema2pojo-core-1.2.1.jar

Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (jsonschema2pojo-core version)	Remediation Possible**
WS-2026-0003	High	7.5	jackson-core-2.15.3.jar	Transitive	1.3.0	❌
CVE-2025-48924	Medium	5.3	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2025-3588	Medium	5.3	jsonschema2pojo-core-1.2.1.jar	Direct	N/A	❌
CVE-2024-47554	Medium	4.3	commons-io-2.11.0.jar	Transitive	1.3.0	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2026-0003

Vulnerable Library - jackson-core-2.15.3.jar

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

Library home page: http://fasterxml.com/

Path to dependency file: /bamboo-generator/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-core/2.15.3/60d600567c1862840397bf9ff5a92398edc5797b/jackson-core-2.15.3.jar

Dependency Hierarchy:

• jsonschema2pojo-core-1.2.1.jar (Root Library)
  • jackson-databind-2.15.3.jar
    • ❌ jackson-core-2.15.3.jar (Vulnerable Library)

Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df

Found in base branch: develop

Vulnerability Details

The non-blocking (async) JSON parser in jackson-core bypasses the maxNumberLength constraint (default: 1000 characters) defined in StreamReadConstraints. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS).

The standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy.

Publish Date: 2026-03-02

URL: WS-2026-0003

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-72hv-8253-57qq

Release Date: 2026-03-02

Fix Resolution (com.fasterxml.jackson.core:jackson-core): 2.18.6

Direct dependency fix Resolution (org.jsonschema2pojo:jsonschema2pojo-core): 1.3.0

Step up your Open Source Security Game with Mend here

CVE-2025-48924

Vulnerable Libraries - commons-lang-2.6.jar, commons-lang3-3.12.0.jar

commons-lang-2.6.jar

Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.

Library home page: http://www.apache.org/

Path to dependency file: /bamboo-generator/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/commons-lang/commons-lang/2.6/ce1edb914c94ebc388f086c6827e8bdeec71ac2/commons-lang-2.6.jar

Dependency Hierarchy:

• jsonschema2pojo-core-1.2.1.jar (Root Library)
  • ❌ commons-lang-2.6.jar (Vulnerable Library)

commons-lang3-3.12.0.jar

Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.

Library home page: https://www.apache.org/

Path to dependency file: /bamboo-generator/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-lang3/3.12.0/c6842c86792ff03b9f1d1fe2aab8dc23aa6c6f0e/commons-lang3-3.12.0.jar

Dependency Hierarchy:

• jsonschema2pojo-core-1.2.1.jar (Root Library)
  • ❌ commons-lang3-3.12.0.jar (Vulnerable Library)

Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df

Found in base branch: develop

Vulnerability Details

Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
StackOverflowError could cause an application to stop.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-07-11

URL: CVE-2025-48924

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-07-11

Fix Resolution: https://github.com/apache/commons-lang.git - commons-lang-3.18.0,org.apache.commons:commons-lang3:3.18.0

Step up your Open Source Security Game with Mend here

CVE-2025-3588

Vulnerable Library - jsonschema2pojo-core-1.2.1.jar

Library home page: https://github.com/joelittlejohn/jsonschema2pojo

Path to dependency file: /bamboo-generator/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jsonschema2pojo/jsonschema2pojo-core/1.2.1/3f29cfd51d988a5f4c3c2da8fe612cc2242e35/jsonschema2pojo-core-1.2.1.jar

Dependency Hierarchy:

• ❌ jsonschema2pojo-core-1.2.1.jar (Vulnerable Library)

Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df

Found in base branch: develop

Vulnerability Details

A vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1.2.2. This issue affects the function apply of the file org/jsonschema2pojo/rules/SchemaRule.java of the component JSON File Handler. The manipulation leads to stack-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Publish Date: 2025-04-14

URL: CVE-2025-3588

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2024-47554

Vulnerable Library - commons-io-2.11.0.jar

The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

Library home page: https://www.apache.org/

Path to dependency file: /bamboo-generator/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/commons-io/commons-io/2.11.0/a2503f302b11ebde7ebc3df41daebe0e4eea3689/commons-io-2.11.0.jar

Dependency Hierarchy:

• jsonschema2pojo-core-1.2.1.jar (Root Library)
  • ❌ commons-io-2.11.0.jar (Vulnerable Library)

Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df

Found in base branch: develop

Vulnerability Details

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.
The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.
This issue affects Apache Commons IO: from 2.0 before 2.14.0.
Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-10-03

URL: CVE-2024-47554

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1

Release Date: 2024-10-03

Fix Resolution (commons-io:commons-io): 2.14.0

Direct dependency fix Resolution (org.jsonschema2pojo:jsonschema2pojo-core): 1.3.0

Step up your Open Source Security Game with Mend here