Executive brief
A vulnerability in a widely used Java data-processing library could allow an attacker to crash a service or cause a significant slowdown. By sending a specially crafted, deeply nested JSON file, an attacker can trigger a memory or processing error when the application attempts to convert that data into a text string. This results in a denial-of-service, potentially making the affected application unavailable to legitimate users.
Technical details
A Denial-of-Service (DoS) vulnerability exists in jackson-databind due to uncontrolled resource consumption (CWE-400) during the serialization of deeply nested JSON structures. The issue occurs specifically when an application reads deeply nested JSON (thousands of levels) into a JsonNode using ObjectMapper.readTree() and then invokes JsonNode.toString(). This process can trigger a StackOverflowError or consume excessive CPU and memory resources. The vulnerability affects versions 2.10.0 through 2.13.x and is fixed in version 2.14.0. As a workaround, developers are advised to use ObjectMapper.writeValueAsString(node) instead of JsonNode.toString().
Affected products
- FasterXML jackson-databind >= 2.10.0, < 2.14.0
Timeline
- 2022-04-05: disclosed: Issue first reported on GitHub
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-06-23: patched: CVE published and fix confirmed in 2.14.0