jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

ALTO 7.5CVE-2026-50193 · GHSA-3wrr-7qpf-2prh · Published 23/06/2026 · updated 25/10/2026

Package	Affected versions	Patched versions
com.fasterxml.jackson.core:jackson-databind Maven	`≥ 2.10.0, < 2.14.0`	`2.14.0`
jackson-databind fasterxml	`≥ 2.10.0, < 2.14.0`	`2.14.0`

Description

Impact

Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service:

Reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree())
Writes out same (or modifided) node using JsonNode.toString()

which can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB).

Patches

Fixed in 2.14.0 via https://github.com/FasterXML/jackson-databind/issues/3447.

Workarounds

Avoid serializing JsonNode using toString(): use ObjectMapper.writeValueAsString(node)

NVD description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.

References

FasterXML/jackson-databind security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-50193 · ADVISORY
FasterXML/jackson-databind · WEB
FasterXML/jackson-databind commit a1fa4ae · WEB
FasterXML/jackson-databind · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.fasterxml.jackson.core:jackson-databind

Maven

≥ 2.10.0, < 2.14.0

2.14.0

jackson-databind

fasterxml

≥ 2.10.0, < 2.14.0

2.14.0

Description

Impact

Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service:

Reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree())
Writes out same (or modifided) node using JsonNode.toString()

which can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB).

Patches

Fixed in 2.14.0 via https://github.com/FasterXML/jackson-databind/issues/3447.

Workarounds

Avoid serializing JsonNode using toString(): use ObjectMapper.writeValueAsString(node)

NVD description