要点
- CVE-2026-50193 是影响 com.fasterxml.jackson.core:jackson-databind, jackson-databind (fasterxml) 的高危 (CVSS 7.5)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.62%，高于 49.5% 的漏洞。
- 修复：升级到 2.14.0 或更高版本。
Description
Impact
Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service:
- Reads deeply nested (1000s of levels) JSON as
JsonNode (ObjectMapper.readTree())
- Writes out same (or modifided) node using
JsonNode.toString()
which can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB).
Patches
Fixed in 2.14.0 via https://github.com/FasterXML/jackson-databind/issues/3447.
Workarounds
Avoid serializing JsonNode using toString(): use ObjectMapper.writeValueAsString(node)
NVD description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.
com.fasterxml.jackson.core:jackson-databind 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free