CVE-2026-50193: jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
Impact
Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service:
1. Reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) 2. Writes out same (or modifided) node using JsonNode.toString()
which can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB).
Patches
Fixed in 2.14.0 via https://github.com/FasterXML/jackson-databind/issues/3447.
Workarounds
Avoid serializing JsonNode using toString(): use ObjectMapper.writeValueAsString(node)
Other sources
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.14.0 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.14.0Patch https://github.com/FasterXML/jackson-databind/issues/3447 - Configuration
Avoid serializing `JsonNode` using `JsonNode.toString()`; instead use `ObjectMapper.writeValueAsString(node)` (not applicable after upgrading beyond the fix in 2.14.0).
jackson-databind (JsonNode serialization) JsonNode.toString() = avoid; use ObjectMapper.writeValueAsString(node)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50193?
CVE-2026-50193 has a medium severity level rated at 6.3 on the CVSS scale.
What impact does CVE-2026-50193 have on applications?
CVE-2026-50193 can lead to a potential Denial-of-Service by causing a StackOverflowError when handling deeply nested JSON.
How do I fix CVE-2026-50193?
To mitigate CVE-2026-50193, avoid processing deeply nested JSON structures with the Jackson Databind library until a patch is applied.
Which software is affected by CVE-2026-50193?
CVE-2026-50193 affects the Jackson Databind library, specifically versions published under maven/com.fasterxml.jackson.core/jackson-databind.
When was CVE-2026-50193 published?
CVE-2026-50193 was published on June 23, 2026.