CVE-2026-95155: FasterXML Jackson DOS Vulnerability

CVE-2026-95155 Overview

CVE-2026-95155 is a denial of service vulnerability in FasterXML Jackson 1.x, specifically the jackson-mapper-asl library. The flaw affects applications that deserialize untrusted JSON through ObjectMapper.readValue. Attackers can submit deeply nested JSON documents that trigger uncontrolled recursion during parsing, exhausting stack space and crashing the Java process.

The vulnerability is tracked under CWE-674: Uncontrolled Recursion. Confirmed affected versions include 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13. The issue is network-exploitable, requires no authentication, and no user interaction.

Critical Impact
Unauthenticated attackers can crash Java applications that parse untrusted JSON with Jackson 1.x by sending a single deeply nested payload.

Affected Products

FasterXML jackson-mapper-asl 1.8.3
FasterXML jackson-mapper-asl 1.9.2, 1.9.11, 1.9.12
FasterXML jackson-mapper-asl 1.9.13

Discovery Timeline

2026-10-15 - CVE-2026-95155 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-95155

Vulnerability Analysis

Jackson 1.x parses JSON input recursively. When ObjectMapper.readValue encounters nested arrays or objects, each level of nesting consumes a frame on the Java Virtual Machine (JVM) call stack. The parser does not enforce a maximum nesting depth before recursion begins.

An attacker who submits a payload containing thousands of opening brackets forces the parser to recurse until the JVM throws a StackOverflowError. In server applications that treat such errors as unrecoverable, the thread or process terminates. Repeated requests sustain the denial of service against any endpoint that deserializes attacker-controlled JSON.

The impact is limited to availability. The flaw does not expose data or allow code execution, but it affects a widely deployed library that is still present in legacy Java services, build pipelines, and transitive dependency trees.

Root Cause

The root cause is uncontrolled recursion [CWE-674] in the parser logic of jackson-mapper-asl. The library lacks an input depth limit, so document structure directly controls stack consumption. Jackson 1.x reached end of life, and fixes are concentrated in the Jackson 2.x branch where StreamReadConstraints enforces a configurable maximum nesting depth.

Attack Vector

Exploitation requires only the ability to send JSON to a vulnerable application. Any HTTP endpoint, message queue consumer, or batch job that invokes ObjectMapper.readValue on untrusted input is a candidate. The attacker sends a payload shaped like [[[[[[...]]]]]] or {"a":{"a":{"a":...}}} with sufficient depth to exceed the configured JVM stack size. Default stack sizes between 512 KB and 1 MB typically fail at a few thousand nesting levels. See GitHub Issue #11 on Jackson and the FasterXML Jackson 1 repository for the upstream discussion.

Detection Methods for CVE-2026-95155

Indicators of Compromise

Repeated java.lang.StackOverflowError entries in application logs with stack traces containing org.codehaus.jackson frames.
HTTP request bodies containing long runs of [ or { characters, or anomalously high nesting depth relative to normal traffic.
Sudden thread death or worker restarts in services that process external JSON.

Detection Strategies

Perform a software composition analysis scan to inventory applications depending on jackson-mapper-asl 1.x, including transitive dependencies.
Add a web application firewall or reverse proxy rule that measures JSON nesting depth and blocks payloads above a sane threshold such as 100.
Alert on StackOverflowError exceptions originating from JSON parsing code paths.

Monitoring Recommendations

Monitor request body size distributions and bracket character density on JSON endpoints.
Track JVM crash and worker restart rates on services that accept external JSON.
Correlate error spikes with source IPs to identify abusive clients and trigger automated blocking.

How to Mitigate CVE-2026-95155

Immediate Actions Required

Inventory all applications using jackson-mapper-asl 1.x and prioritize internet-facing services.
Enforce a JSON payload size limit and a maximum nesting depth at the gateway or reverse proxy layer.
Restrict JSON deserialization endpoints to authenticated clients where feasible to reduce attack surface.

Patch Information

Jackson 1.x is end of life. Migrate to Jackson 2.x (com.fasterxml.jackson.core:jackson-databind) and configure StreamReadConstraints with a bounded maxNestingDepth. Review the FasterXML Jackson 1 repository and the referenced issue tracker for migration guidance.

Workarounds

Pre-validate JSON payloads with a lightweight depth check before invoking ObjectMapper.readValue.
Wrap deserialization calls in handlers that catch StackOverflowError and reject the request without terminating the worker.
Increase JVM stack size only as a temporary measure; it raises the exploitation threshold but does not remove the flaw.

bash

# Example gateway-side limit using NGINX to cap JSON body size
client_max_body_size 64k;

# Example application-side depth check before Jackson 2.x readValue
# StreamReadConstraints constraints = StreamReadConstraints.builder()
#     .maxNestingDepth(100)
#     .build();
# JsonFactory factory = JsonFactory.builder()
#     .streamReadConstraints(constraints)
#     .build();
# ObjectMapper mapper = new ObjectMapper(factory);