Vulnerability Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fasterxml | Jackson-Databind | >= 2.10.0, < 2.14.0 |
Related Weaknesses (CWE)
References
- https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f1Patch
- https://github.com/FasterXML/jackson-databind/issues/3447ExploitIssue Tracking
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpfPatchVendor Advisory
FAQ
What is CVE-2026-50193?
CVE-2026-50193 is a vulnerability with a CVSS score of 7.5 (HIGH). jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends d...
How severe is CVE-2026-50193?
CVE-2026-50193 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-50193?
Check the references section above for vendor advisories and patch information. Affected products include: Fasterxml Jackson-Databind.