CVE-2026-50193CWE-400

jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

Medium · published June 23, 2026

CVSS v4.0
6.3
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00616 · 48.9th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-06-23T21:00Z
EPSS history
Timeline
  • 23 JUN 21:00Z
    jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
    cvelistv5