CVE-2026-50193: jackson-databind DoS Vulnerability

CVE-2026-50193 Overview

CVE-2026-50193 is a Denial-of-Service vulnerability in jackson-databind, the data-binding and tree-model component of the Jackson Data Processor for Java. Versions from 2.13.0 up to (but not including) 2.14.0 fail to handle deeply nested JSON when applications read input as a JsonNode via ObjectMapper.readTree() and then serialize it back using JsonNode.toString(). An attacker can submit small (around 2kB) payloads containing thousands of nested arrays to trigger a StackOverflowError and consume significant server resources. The issue is tracked under [CWE-400: Uncontrolled Resource Consumption]. It is fixed in jackson-databind 2.14.0.

Critical Impact
Remote, unauthenticated attackers can exhaust server resources using small deeply nested JSON payloads, causing service-level Denial of Service against any application that parses untrusted JSON into a JsonNode and serializes it back to string form.

Affected Products

FasterXML jackson-databind 2.13.0 through 2.13.x (prior to 2.14.0)
Java applications using ObjectMapper.readTree() to parse untrusted JSON
Downstream frameworks and libraries that embed vulnerable jackson-databind versions

Discovery Timeline

Reported by Deniz Husaj (denizhusaj@github) as jackson-databind issue #3447
Fix released in jackson-databind 2.14.0
2026-06-23 - CVE-2026-50193 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-50193

Vulnerability Analysis

The vulnerability is an algorithmic and recursion-based resource exhaustion flaw. JsonNode.toString() walks the parsed tree recursively to produce its string representation. When the tree contains thousands of nested arrays or objects, the recursive traversal grows the JVM call stack until it triggers a StackOverflowError. Because the input is compact (roughly 2kB for 1000 levels of nesting), attackers can issue many concurrent requests with minimal bandwidth and force the target to expend CPU and stack resources repeatedly. The flaw maps to [CWE-400] and produces an availability-only impact, with no effect on confidentiality or integrity.

Root Cause

The root cause is unbounded recursion during tree serialization. The JsonNode.toString() implementation in affected versions does not enforce a depth limit when traversing nested containers. Any code path that reads attacker-controlled JSON into a JsonNode and later serializes it back, for example for logging, response generation, or persistence, inherits the recursion behavior. Version 2.14.0 introduces fixes that prevent the StackOverflowError on deeply nested trees.

Attack Vector

Exploitation is remote and unauthenticated when the vulnerable application exposes an HTTP endpoint that ingests JSON via ObjectMapper.readTree(). The attacker sends a payload such as [[[[ ... ]]]] with thousands of nested brackets. The server parses the structure successfully but crashes or stalls when toString() is invoked on the resulting node. Repeated parallel requests amplify resource consumption against the host.

text

# Source: https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c
# release-notes/CREDITS-2.x

 Jan Judas (kostislav@github)
   * Contributed #3445: Do not strip generic type from `Class<C>` when resolving `JavaType`
   (2.14.0)

Deniz Husaj (denizhusaj@github)
  * Reported #3447: Deeply nested JsonNode throws StackOverflowError for toString()
  (2.14.0)

text

# Source: https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c
# release-notes/VERSION-2.x

#3443: Do not strip generic type from `Class<C>` when resolving `JavaType`
 (contributed by Jan J)
#3447: Deeply nested JsonNode throws StackOverflowError for toString()
 (reported by Deniz H)
#3476: Implement `JsonNodeFeature.WRITE_NULL_PROPERTIES` to allow skipping
  JSON `null` values on writing

These patch notes document the fix shipped in jackson-databind 2.14.0 addressing the toString() stack overflow on deeply nested trees.

Detection Methods for CVE-2026-50193

Indicators of Compromise

Java stack traces containing java.lang.StackOverflowError originating in com.fasterxml.jackson.databind.node.*toString or serialize methods.
HTTP request bodies under a few kilobytes that contain hundreds or thousands of consecutive [ or { characters.
Sudden spikes in JVM thread CPU usage correlated with JSON parsing endpoints, followed by 5xx responses or process restarts.

Detection Strategies

Inventory application dependencies and flag any module using com.fasterxml.jackson.core:jackson-databind between 2.13.0 and 2.13.x.
Inspect web application firewall (WAF) and API gateway logs for JSON payloads whose nesting depth exceeds an application-defined threshold, for example 64 levels.
Correlate StackOverflowError entries in application logs with the source IP addresses and endpoints of the originating requests.

Monitoring Recommendations

Alert on repeated JVM crashes or container restarts on services that accept JSON input.
Monitor request body entropy and bracket-character density to surface nested-structure abuse.
Track dependency versions in CI/CD using software composition analysis (SCA) to catch regressions to vulnerable jackson-databind releases.

How to Mitigate CVE-2026-50193

Immediate Actions Required

Upgrade jackson-databind to 2.14.0 or later across all services and shaded/bundled dependencies.
Identify code paths that call ObjectMapper.readTree() on untrusted input followed by JsonNode.toString() and prioritize them for patching.
Enforce request body size limits and JSON nesting-depth limits at the API gateway or WAF until upgrades are complete.

Patch Information

The fix is shipped in jackson-databind 2.14.0. See the GitHub Security Advisory GHSA-3wrr-7qpf-2prh, the upstream issue #3447, and the release commit a1fa4ae4 for full details.

Workarounds

Reject JSON payloads whose nesting depth exceeds a safe limit by pre-parsing with a streaming parser such as JsonParser and counting START_ARRAY / START_OBJECT tokens.
Avoid calling JsonNode.toString() on attacker-controlled trees; serialize through ObjectMapper.writeValueAsString(node) with bounded depth or convert to typed POJOs.
Apply low per-request size limits (for example 8kB) on endpoints that do not require large JSON bodies.

bash

# Maven dependency update to the fixed version
mvn versions:use-dep-version \
  -Dincludes=com.fasterxml.jackson.core:jackson-databind \
  -DdepVersion=2.14.0 -DforceVersion=true

# Gradle equivalent (build.gradle)
# implementation 'com.fasterxml.jackson.core:jackson-databind:2.14.0'