CVE-2023-35116

DISPUTED jackson-databind through 2.15.2 allows attackers to cause a
denial of service or other unspecified impact via a crafted object that
uses cyclic dependencies. NOTE: the vendor’s perspective is that this is
not a valid vulnerability report, because the steps of constructing a
cyclic data structure and trying to serialize it cannot be achieved by an
external attacker.

Notes