Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Jackson Databind may crash from deeply nested JSON

CVE-2026-50193 · published 4 months ago
Summary

Versions 2.13.0 through 2.14.0 of Jackson Databind can become very slow or stop working if a request contains JSON that is nested thousands of levels deep. This happens when the software reads such JSON into a tree structure and then writes it out again. Updating the library to version 2.14.0 or later removes the problem.

What to do
  • Update fasterxml com.fasterxml.jackson.core:jackson-databind to version 2.14.0.
  • Update root io.root.com.fasterxml.jackson.core:jackson-databind to version 2.12.4-root.io.4.
  • Update fasterxml com.fasterxml.jackson.core:jackson-databind to version 2.12.4-aikido.4.
  • Update root io.root.com.fasterxml.jackson.core:jackson-databind to version 2.12.5-root.io.4.
  • Update fasterxml com.fasterxml.jackson.core:jackson-databind to version 2.12.5-aikido.4.
  • Update com.fasterxml.jackson.core:jackson-databind to version 2.12.7.1-aikido.3.
  • Update io.root.com.fasterxml.jackson.core:jackson-databind to version 2.12.7.1-root.io.3.
  • Update com.fasterxml.jackson.core:jackson-databind to version 2.13.5-aikido.1.
  • Update io.root.com.fasterxml.jackson.core:jackson-databind to version 2.13.5-root.io.1.
  • Update fasterxml jackson-databind to version 2.14.0 or later.
Affected software
Ecosystem VendorProductAffected versions
maven fasterxml com.fasterxml.jackson.core:jackson-databind >= 2.10.0, <= 2.13.5
Fix: upgrade to 2.14.0
Maven fasterxml com.fasterxml.jackson.core:jackson-databind >= 2.10.0, < 2.14.0
Fix: upgrade to 2.14.0
Debian:11 debian jackson-databind All versions
Debian:12 debian jackson-databind All versions
Debian:13 debian jackson-databind All versions
Debian:14 debian jackson-databind All versions
– fasterxml jackson-databind >= 2.10.0, < 2.14.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
Root:Maven root io.root.com.fasterxml.jackson.core:jackson-databind < 2.12.4-root.io.4
< 2.12.5-root.io.4
Fix: upgrade to 2.12.4-root.io.4
Root:Maven fasterxml com.fasterxml.jackson.core:jackson-databind < 2.12.4-aikido.4
< 2.12.5-aikido.4
Fix: upgrade to 2.12.4-aikido.4
Root:Maven – com.fasterxml.jackson.core:jackson-databind < 2.12.7.1-aikido.3
< 2.13.5-aikido.1
Fix: upgrade to 2.12.7.1-aikido.3
Root:Maven – io.root.com.fasterxml.jackson.core:jackson-databind < 2.12.7.1-root.io.3
< 2.13.5-root.io.1
Fix: upgrade to 2.12.7.1-root.io.3
Ubuntu:Pro:14.04:LTS canonical jackson-databind All versions
Original advisory text
CVE-2026-50193 in com.fasterxml.jackson.core:jackson-databind - Patched by Root
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published23 Jun 2026
Updated4 Nov 2026
First seen23 Jun 2026
Sources
ROOT-APP-MAVEN-CVE-2026-50193 · OSV
CVE-2026-50193 · NVD
GHSA-3wrr-7qpf-2prh · GHSA
GHSA-3wrr-7qpf-2prh · OSV
DEBIAN-CVE-2026-50193 · OSV
CVE-2026-50193 · OSV
UBUNTU-CVE-2026-50193 · OSV
Track software like this
Free during beta