Denial-of-Service Vulnerability in Jackson Databind Library by FasterXML

CVE-2026-50193

What is CVE-2026-50193?

The Jackson Databind library, utilized for JSON data-binding and tree-model operations, is susceptible to a Denial-of-Service attack when processing deeply nested JSON. Versions 2.13.0 through 2.14.0 may encounter significant resource consumption if a service reads and writes deeply nested JSON structures through the ObjectMapper.readTree() and JsonNode.toString() methods. Attackers can exploit this vulnerability by sending JSON data with extensive nesting levels, leading to resource exhaustion. This issue was addressed in version 2.14.0.

References