CVE-2026-50193MEDIUMCVSS 0.0

jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

Published Jun 23, 2026·Updated Jun 23, 2026

Description

### Impact Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service: 1. Reads deeply nested (1000s of levels) JSON as `JsonNode` (ObjectMapper.readTree()) 2. Writes out same (or modifided) node using `JsonNode.toString()` which can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). ### Patches Fixed in 2.14.0 via https://github.com/FasterXML/jackson-databind/issues/3447. ### Workarounds Avoid serializing `JsonNode` using `toString()`: use ObjectMapper.writeValueAsString(node)

Affected Packages (1)

com.fasterxml.jackson.core:jackson-databindMAVEN
From 2.10.0
Fixed in = 2.13.5

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free