CVE-2025-52999

What it actually does

The flaw is an uncontrolled recursion/resource-exhaustion condition in Jackson's low-level streaming JSON parser before version 2.15.0. When an application parses attacker-supplied JSON or other structured input with extremely deep nesting, the parser can recurse until the Java thread stack is exhausted, causing a StackOverflowError. Depending on how the application handles parser failures, this can terminate the request-handling thread, fail the transaction, or destabilize the service. The issue affects applications that directly use jackson-core and applications using jackson-databind because databind relies on jackson-core for parsing. The fixed implementation adds configurable stream constraints, including a default maximum nesting depth of 1000, and throws StreamConstraintsException instead of exhausting the stack.

Why it matters to the business

An unauthenticated remote attacker may be able to make affected services unavailable by sending specially crafted deeply nested input to any feature, API, message consumer, file import, or integration endpoint that parses untrusted JSON with a vulnerable Jackson version. The primary business risk is service disruption: failed API requests, degraded application availability, increased error rates, worker crashes, and potential cascading outages in systems that automatically retry failed parsing jobs. There is no indication from the provided data of confidentiality or integrity impact, no CISA KEV listing, no known ransomware use, low EPSS probability, and no reported mature public exploit, so prioritization should be driven by whether exposed applications parse untrusted input and how critical those applications are.

How an attack unfolds

An attacker identifies an application endpoint, import function, queue consumer, webhook, or service integration that accepts JSON or data later parsed by Jackson. The attacker submits a payload containing an extremely deep sequence of nested arrays or objects, such as thousands of repeated '[' characters followed by matching closing brackets, or deeply nested object properties. In vulnerable versions of jackson-core, parsing this payload can recurse through the nested structure until the JVM throws StackOverflowError. If the application does not isolate or recover from this failure cleanly, the affected request fails, worker threads may die, logs fill with stack traces, and repeated submissions can keep the service in a degraded or unavailable state. In fixed versions, the parser enforces a maximum nesting depth and rejects the payload with StreamConstraintsException before stack exhaustion occurs.

How to fix it

Upgrade jackson-core to version 2.15.0 or later wherever it is present, including transitive dependencies pulled in by jackson-databind or framework starters. For source-based consumers of fasterxml/jackson-core, include the fixed commit a2c0bdcfb9aae8fca555240e63e57c1d9e6f8079 or a released version containing the stream constraints change. For Mageia 6 netatalk packaging listed in the affected products, update to 3.1.12-1.1.mga6 or later. After upgrading, ensure the application uses the fixed Jackson libraries at runtime and not an older shaded, bundled, or container-provided copy. Where immediate upgrade is not possible, reduce exposure by rejecting untrusted JSON from unauthenticated sources, enforcing maximum request body sizes, applying API gateway or WAF limits for excessive nesting, validating input before parsing, isolating parsing workloads, and configuring timeouts and retry limits. On fixed Jackson versions, consider explicitly configuring StreamReadConstraints with a maximum nesting depth appropriate for the application if the default depth of 1000 is too permissive for business requirements.

How to confirm the fix worked

Confirm dependency resolution shows jackson-core 2.15.0 or later in all built artifacts, container images, application servers, and dependency lockfiles. Use software composition analysis, Maven or Gradle dependency trees, SBOM scans, and runtime classpath inspection to identify direct, transitive, shaded, or duplicated older Jackson jars. Functional validation can be performed in a non-production environment by sending a deliberately over-nested JSON payload to representative parsing paths: fixed applications should reject it with StreamConstraintsException or a controlled 4xx error rather than producing StackOverflowError or crashing a worker. Verify logs no longer show java.lang.StackOverflowError from Jackson parsing code when malformed deeply nested payloads are tested. For packaged systems, confirm the installed Mageia netatalk package is 3.1.12-1.1.mga6 or later where applicable.

Typical attack path

1. Find an internet-facing API, webhook, upload, message-processing, or integration path that accepts JSON or structured input.
2. Confirm or infer that the backend Java application uses a vulnerable jackson-core version prior to 2.15.0, directly or through jackson-databind.
3. Create a JSON payload with nesting depth high enough to exceed the JVM stack, such as thousands of nested arrays or objects.
4. Submit the payload to the vulnerable parsing path without needing authentication if the endpoint is public, or with low-privilege access if the parser is behind authentication.
5. Trigger StackOverflowError during parsing, causing request failure and possible worker-thread or service instability.
6. Repeat or automate submissions to sustain elevated error rates and deny service to legitimate users.

How to detect it

To determine whether exploitation has already occurred, review application, API gateway, load balancer, WAF, APM, and JVM logs for spikes in failed JSON parsing requests, HTTP 400/413/500 responses, thread deaths, worker restarts, or java.lang.StackOverflowError events tied to request bodies with extreme nesting. Focus on endpoints that accept JSON, webhooks, file imports, batch ingestion, message queues, and partner integrations. In application logs, look for stack traces involving com.fasterxml.jackson.core, com.fasterxml.jackson.databind, JsonParser, ReaderBasedJsonParser, UTF8StreamJsonParser, or parsing operations immediately before StackOverflowError. In fixed environments, repeated StreamConstraintsException messages may indicate attempted probing or exploitation attempts that were blocked. Network and WAF telemetry may show very long runs of nested '[' or '{' characters in request bodies, abnormal request-body depth, large malformed JSON payloads, or repeated requests from the same source that receive server errors. Correlate these events with service restarts, JVM crash reports, orchestrator pod/container restarts, elevated CPU/error rates, and retry storms from message-processing systems.

• java.lang.StackOverflowError
• com.fasterxml.jackson.core
• com.fasterxml.jackson.databind
• com.fasterxml.jackson.core.exc.StreamConstraintsException
• Document nesting depth
• Depth
• JsonParser
• UTF8StreamJsonParser
• ReaderBasedJsonParser
• JsonMappingException
• Unexpected end-of-input within/between Object entries
• Unexpected end-of-input within/between Array entries
• [[[[[[[[[[[[[[[[[[[[
• {{{{{{{{{{{{{{{{{{{{
• Caused by: java.lang.StackOverflowError
• StackOverflowError at com.fasterxml.jackson

What your security team should do

• Inventory all Java applications, services, batch jobs, message consumers, and third-party products that include jackson-core or jackson-databind, prioritizing internet-facing and unauthenticated JSON parsing paths.
• Upgrade jackson-core to 2.15.0 or later, or apply vendor package updates such as netatalk 3.1.12-1.1.mga6 for Mageia 6 where applicable.
• Search dependency trees and built artifacts for older jackson-core jars, including shaded copies and application-server-provided libraries that may override the intended fixed version.
• Apply compensating controls until upgrades are complete: request size limits, nesting-depth validation, WAF/API gateway rules, rate limits, authentication requirements, and queue retry caps.
• Add negative tests for deeply nested JSON to CI/CD and API test suites to ensure parsing failures are controlled and do not cause stack exhaustion.
• Monitor application logs and APM telemetry for StackOverflowError, StreamConstraintsException spikes, unusual malformed JSON rates, and repeated requests that fail during JSON parsing.
• Treat repeated exploitation attempts against critical exposed services as a denial-of-service incident even though this vulnerability is not currently listed in KEV and has low EPSS.