CVE-2026-50193 Details

A denial-of-service vulnerability has been identified in Jackson Databind versions 2.10.0 prior to 2.14.0. The issue arises when a service processes deeply nested JSON—thousands of levels deep—using the JsonNode representation. If the service reads this complex JSON with ObjectMapper.readTree() and then attempts to serialize the same or modified JsonNode using JsonNode.toString(), it can trigger a StackOverflowError. This serialization process can consume substantial resources, especially with concurrent, smaller requests, such as those containing 1000 nested arrays, which only amount to 2KB.

Users can upgrade to Jackson Databind version 2.14.0 or later, where this vulnerability has been fixed. Additionally, avoid using JsonNode.toString() for serialization; instead, use ObjectMapper.writeValueAsString(node) to safely convert the JsonNode to a string.