jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
### Impact Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service: 1. Reads deeply nested (1000s of levels) JSON as `JsonNode` (ObjectMapper.readTree()) 2. Writes out same (or modifided) node using `JsonNode.toString()` which can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). ### Patches Fixed in 2.14.0 via https://github.com/FasterXML/jackson-databind/issues/3447. ### Workarounds Avoid serializing `JsonNode` using `toString()`: use ObjectMapper.writeValueAsString(node)
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-50193US | high7.5 | — | ||
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists w… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/FasterXML/jackson-databindPACKAGE
- https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8cWEB
- https://github.com/FasterXML/jackson-databind/issues/3447WEB
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prhWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-50193ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan