CVE-2026-50193

What it actually does

This vulnerability is a denial-of-service condition in jackson-databind versions 2.13.x before 2.14.0. It is only reachable when an application parses attacker-controlled, deeply nested JSON into a JsonNode tree using ObjectMapper.readTree() and then serializes the same or modified node with JsonNode.toString(). Extremely deep structures, such as thousands of nested arrays, can be very small on the wire but expensive to process, causing excessive CPU use, stack exhaustion, garbage collection pressure, request thread starvation, or process instability.

Why it matters to the business

An attacker may be able to degrade or interrupt API and application availability by sending many small but deeply nested JSON requests to vulnerable endpoints. The impact is most relevant for internet-facing Java services that accept arbitrary JSON and use Jackson tree-model processing. EPSS is currently low and this is not listed in CISA KEV, but exploitation is low-complexity where the vulnerable parsing and serialization pattern exists, so exposed services should still be upgraded or constrained.

How an attack unfolds

An attacker first identifies an HTTP endpoint or message-ingestion interface that accepts JSON input and is backed by jackson-databind 2.13.x. They then send JSON containing thousands of nested arrays or objects, for example a compact payload made mostly of repeated opening and closing brackets. If the application reads that payload into a JsonNode with ObjectMapper.readTree() and later calls JsonNode.toString(), the serialization path consumes disproportionate resources relative to the request size. By repeating these requests concurrently, the attacker can tie up application worker threads, increase CPU and memory pressure, trigger JVM errors such as StackOverflowError or OutOfMemoryError, and cause slow responses, 5xx errors, or service restarts.

How to fix it

Upgrade jackson-databind to version 2.14.0 or later. If direct upgrades are not immediately possible, override transitive dependency resolution so all deployed components use a fixed jackson-databind version. As defense in depth, enforce maximum JSON nesting depth, maximum request body size, request rate limits, and timeouts at API gateways, reverse proxies, and application input-validation layers. Avoid accepting arbitrary deeply nested JSON where it is not required, and review code paths that combine ObjectMapper.readTree() with JsonNode.toString() on untrusted input.

How to confirm the fix worked

Confirm software composition scans, build manifests, dependency lockfiles, and runtime classpaths no longer include jackson-databind 2.13.x and instead resolve to 2.14.0 or later. Test representative JSON endpoints with intentionally nested but safe-depth payloads and verify that excessive nesting is rejected quickly with a controlled 4xx response rather than processed deeply. Confirm API gateway, WAF, or application controls enforce documented nesting, body-size, and rate limits. Review application performance under test to ensure deeply nested JSON does not cause abnormal CPU, memory, garbage collection, thread exhaustion, or JVM exceptions.

Typical attack path

1. Find a Java service or API endpoint that accepts JSON from unauthenticated or low-privileged users.
2. Send probe requests containing deeply nested JSON arrays or objects and observe response latency, errors, or connection resets.
3. Confirm the target processes the payload using a vulnerable Jackson tree-model path by observing repeated slowdowns or server-side errors.
4. Increase request concurrency using relatively small payloads with thousands of nesting levels.
5. Sustain the request stream until worker threads, CPU, memory, or JVM stability are affected, causing denial of service.

How to detect it

To determine whether exploitation has already occurred, review API gateway, reverse proxy, WAF, load balancer, application, JVM, container, and APM logs for periods where many small JSON requests were followed by elevated latency, request timeouts, 5xx responses, CPU spikes, garbage collection storms, thread pool exhaustion, or process restarts. Focus on endpoints that accept JSON bodies and correlate requests with unusually high nesting depth or dense sequences of '[' and '{' characters. In application logs and crash artifacts, look for Java exceptions involving Jackson tree serialization, StackOverflowError, OutOfMemoryError, long garbage collection pauses, killed containers, or thread dumps showing Jackson JsonNode serialization methods. If request bodies are captured in WAF or forensic logs, search for compact payloads containing hundreds or thousands of repeated nested brackets, especially repeated concurrent submissions from the same source address, user agent, or network block.

• com.fasterxml.jackson.databind.JsonNode.toString
• com.fasterxml.jackson.databind.ObjectMapper.readTree
• java.lang.StackOverflowError
• java.lang.OutOfMemoryError
• GC overhead limit exceeded
• OutOfMemoryError: Java heap space
• StackOverflowError: null
• com.fasterxml.jackson.databind.node.ArrayNode
• com.fasterxml.jackson.databind.node.ObjectNode
• [[[[[[[[[[[[[[[[[[[[
• {{{{{{{{{{{{{{{{{{{{
• HTTP 500
• HTTP 503
• request timed out
• upstream timed out
• connection reset by peer

What your security team should do

• Inventory Java applications, APIs, workers, and message consumers that include jackson-databind 2.13.x, including transitive dependencies.
• Prioritize internet-facing JSON ingestion services and services that parse untrusted JSON into JsonNode trees.
• Upgrade jackson-databind to 2.14.0 or later and ensure dependency management prevents older transitive versions from being packaged.
• Add or verify JSON nesting-depth limits, request-size limits, rate limits, and application timeouts at the edge and in application code.
• Search recent application, gateway, WAF, JVM, and APM logs for bursts of small JSON requests followed by latency spikes, 5xx errors, StackOverflowError, OutOfMemoryError, or container restarts.
• Create detection logic for unusually high bracket density or excessive JSON nesting in request bodies where logging or inspection is permitted.
• Run targeted regression tests against endpoints using ObjectMapper.readTree() and JsonNode.toString() to confirm malicious nesting is rejected safely.