CVE-2025-49128 is a medium-severity vulnerability in FasterXML jackson-core affecting versions >=2.0.0 <2.13.0. The flaw lies in the JsonLocation._appendSourceDesc method, which incorrectly reads from the start of a byte array rather than the logical payload start when parsing JSON with offset and length. This causes up to 500 bytes of unintended memory content to be included in exception messages, risking information disclosure in environments using pooled or reused buffers such as Netty or Vert.x. The vulnerability was silently fixed in version 2.13.0 released on September 30, 2021. Mitigations include upgrading to 2.13.0 or later, or disabling exception message exposure and source inclusion in exceptions to prevent leakage.

The vulnerability can lead to partial disclosure of memory content (up to 500 bytes) in exception messages generated during JSON parsing errors. This may expose sensitive information if the application uses pooled or reused buffers. There is no impact on integrity or availability. The CVSS 3.1 base score is 4.0 (medium severity), reflecting limited confidentiality impact with low attack complexity and no privileges required.

A fix is available by upgrading jackson-core to version 2.13.0 or later. If upgrading is not immediately feasible, applications should mitigate by disabling the exposure of exception messages to clients and/or disabling source inclusion in exceptions to prevent embedding source content in error messages, thereby avoiding information leakage.