fasterxml/jackson-databind · Security
jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
- GHSA ID
- GHSA-3wrr-7qpf-2prh
- CVE ID
- CVE-2026-50193
- Severity
- medium
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v4
- 6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Description
Impact
Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service:
- Reads deeply nested (1000s of levels) JSON as
JsonNode(ObjectMapper.readTree()) - Writes out same (or modifided) node using
JsonNode.toString()
which can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB).
Patches
Fixed in 2.14.0 via https://github.com/FasterXML/jackson-databind/issues/3447.
Workarounds
Avoid serializing JsonNode using toString(): use ObjectMapper.writeValueAsString(node)
CWEs
- CWE-400 · Uncontrolled Resource Consumption
References
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh ↗
- https://github.com/FasterXML/jackson-databind/issues/3447 ↗
- https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-50193 ↗
- https://github.com/advisories/GHSA-3wrr-7qpf-2prh ↗