CVE-2026-50193: Jackson-Databind Denial-of-Service via Deeply Nested JSON

Technical summary

CVE-2026-50193 is a resource exhaustion vulnerability (CWE-400) in jackson-databind versions 2.13.0 to 2.13.x. The vulnerability manifests when an application calls ObjectMapper.readTree() to parse a JSON structure with extreme nesting depth, then calls JsonNode.toString() to serialize the result. The tree model's traversal during serialization consumes disproportionate CPU and memory relative to payload size because each nesting level incurs overhead. An attacker exploiting this does not require authentication, special privileges, or user interaction. The vector is entirely network-based and does not require complexity in attack setup, yielding a CVSS 3.1 score of 7.5 (HIGH). Version 2.14.0 resolves the issue through improved handling of deeply nested structures.

Business impact

Organizations using jackson-databind 2.13.x in production services face availability risk if they process untrusted JSON input. A single attacker or coordinated requests can degrade or exhaust application responsiveness, potentially impacting downstream services, APIs, and user experience. The low barrier to exploitation—small requests, no authentication—means public-facing applications are at particular risk. Financial services, cloud platforms, and integration hubs that parse JSON at scale are especially vulnerable. Recovery requires patching or architectural mitigation, both of which demand coordination and testing.

Affected systems

jackson-databind versions 2.13.0 through 2.13.x are affected. Version 2.14.0 and later contain the fix. Any Java application using the affected versions to read and serialize untrusted JSON (especially from APIs, message queues, or user input) is at risk. The vulnerability is NOT present in 2.12.x and earlier, nor in 2.14.0+. Organizations should audit their dependency trees for jackson-databind usage and version.

Exploitability

This vulnerability is easily exploitable by a remote, unauthenticated attacker. No user interaction, special configuration, or exploit code is required—a simple HTTP POST or API call with a deeply nested JSON payload will trigger the vulnerability. The attack surface is broad for any service accepting JSON input. Proof-of-concept generation is trivial (nested arrays or objects). The primary constraint is application-level: the service must explicitly use ObjectMapper.readTree() and serialize the result, which is a common pattern in REST APIs and data processing pipelines. No public exploit code is known to be actively circulating, but the low complexity means rapid weaponization is possible.

Remediation

Upgrade jackson-databind to version 2.14.0 or later. This is the definitive fix. Organizations unable to upgrade immediately should implement input validation to reject JSON with nesting depth exceeding a reasonable threshold (e.g., 100 levels) before passing to jackson-databind. Alternatively, disable direct ObjectMapper.readTree() processing of untrusted input and use safer alternatives like streaming parsers that do not construct the full tree in memory. Monitor for spikes in CPU or memory consumption during JSON processing as a detection signal. Rate limiting on JSON payload size and parsing operations provides defense-in-depth.

Patch guidance

Apply jackson-databind version 2.14.0 or later as soon as feasible. If your application depends on jackson-databind transitively (e.g., via Spring Boot, Quarkus, or other frameworks), verify that your framework version or Spring-boot BOM also upgrades the transitive jackson-databind dependency. Test patching in a staging environment first, particularly if you have custom Jackson configuration or serialization logic. Most upgrades within the 2.14+ line are backward-compatible for common use cases, but review release notes for any breaking changes specific to your version chain. Prioritize patching for services that accept JSON from untrusted sources or the internet.

Detection guidance

Monitor application logs and metrics for sudden increases in CPU usage, garbage collection activity, or memory consumption that correlate with JSON parsing. Implement request-level logging that captures payload size and nesting depth before passing to jackson-databind. Set alerts for outlier values—e.g., JSON payloads larger than expected or unusually deep nesting. Network-based detection is difficult without decoding JSON; focus on behavioral signals (high CPU, thread exhaustion, slow API responses). In production, correlate spikes with access logs to identify source IPs or API endpoints being targeted. If your application supports it, enable Jackson's feature flags to log warnings on deep nesting during deserialization.

Why prioritize this

This vulnerability merits HIGH priority for any organization running jackson-databind 2.13.x in production, particularly for internet-facing or API-driven services. The ease of exploitation, lack of preconditions (no authentication, no user action), and significant resource exhaustion impact (HIGH severity, CVSS 7.5) make it an attractive target for attackers seeking to disrupt availability. It is not yet listed on the CISA KEV catalog, but given the low barrier to weaponization, rapid adoption among threat actors is plausible. Patching is straightforward and low-risk for most deployments. Delay increases exposure window.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible, unauthenticated denial-of-service attack with no user interaction required. The attack vector is low complexity and affects availability without requiring special privileges or modifying data. The score appropriately captures the operational risk: an attacker can reliably degrade service responsiveness with minimal reconnaissance. Context-specific risk is higher for public APIs, critical infrastructure, and SaaS platforms with shared computational resources where a single compromised tenant or attacker can affect others.

Frequently asked questions