En bref
- CVE-2026-50193 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant com.fasterxml.jackson.core:jackson-databind, jackson-databind (fasterxml).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.62%, plus élevée que 49.5% des vulnérabilités.
- Correctif : mettre à jour vers 2.14.0 ou plus récent.
Description
Impact
Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service:
- Reads deeply nested (1000s of levels) JSON as
JsonNode (ObjectMapper.readTree())
- Writes out same (or modifided) node using
JsonNode.toString()
which can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB).
Patches
Fixed in 2.14.0 via https://github.com/FasterXML/jackson-databind/issues/3447.
Workarounds
Avoid serializing JsonNode using toString(): use ObjectMapper.writeValueAsString(node)
NVD description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.
Autres vulnérabilités de com.fasterxml.jackson.core:jackson-databind
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free