CVE-2025-52999 jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data
Attackers can cause a denial of service via stack overflow by providing deeply nested JSON input to applications using jackson-core.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-52999?
CVE-2025-52999 is a high-severity denial of service vulnerability in FasterXML jackson-core, published on 25 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.
Weakness: CWE-121
Which versions are affected by CVE-2025-52999?
2 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-core.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-core Maven | All versions | 2.15.0 |
com.fasterxml.jackson.core:jackson-core Maven | All versions | 2.15.0 |
Linux distribution packages (38)
apache-commons-collections AlmaLinux:8 | All versions | 3.2.2-10.module_el8.5.0+2577+9e95fe00 |
apache-commons-lang AlmaLinux:8 | All versions | 2.6-21.module_el8.5.0+2577+9e95fe00 |
apache-commons-net AlmaLinux:8 | All versions | 3.6-3.module_el8.5.0+2577+9e95fe00 |
bea-stax-api AlmaLinux:8 | All versions | 1.2.0-16.module_el8.5.0+2577+9e95fe00 |
fasterxml-oss-parent AlmaLinux:8 | All versions | 69-1.module_el8.10.0+4034+20822525 |
glassfish-fastinfoset AlmaLinux:8 | All versions | 1.2.13-9.module_el8.5.0+2577+9e95fe00 |
glassfish-jaxb-api AlmaLinux:8 | All versions | 2.2.12-8.module_el8.5.0+2577+9e95fe00 |
glassfish-jaxb-core AlmaLinux:8 | All versions | 2.2.11-12.module_el8.10.0+3791+e0637953 |
glassfish-jaxb-runtime AlmaLinux:8 | All versions | 2.2.11-12.module_el8.10.0+3791+e0637953 |
glassfish-jaxb-txw2 AlmaLinux:8 | All versions | 2.2.11-12.module_el8.10.0+3791+e0637953 |
jackson-annotations AlmaLinux:8 | All versions | 2.19.1-1.module_el8.10.0+4034+20822525 |
jackson-bom AlmaLinux:8 | All versions | 2.19.1-1.module_el8.10.0+4034+20822525 |
jackson-core AlmaLinux:8 | All versions | 2.19.1-1.module_el8.10.0+4034+20822525 |
jackson-databind AlmaLinux:8 | All versions | 2.19.1-1.module_el8.10.0+4034+20822525 |
jackson-jaxrs-json-provider AlmaLinux:8 | All versions | 2.19.1-1.module_el8.10.0+4034+20822525 |
jackson-jaxrs-providers AlmaLinux:8 | All versions | 2.19.1-1.module_el8.10.0+4034+20822525 |
jackson-module-jaxb-annotations AlmaLinux:8 | All versions | 2.19.1-1.module_el8.10.0+4034+20822525 |
jackson-modules-base AlmaLinux:8 | All versions | 2.19.1-1.module_el8.10.0+4034+20822525 |
jackson-parent AlmaLinux:8 | All versions | 2.19.1-1.module_el8.10.0+4034+20822525 |
jakarta-commons-httpclient AlmaLinux:8 | All versions | 1:3.1-28.module_el8.5.0+2577+9e95fe00 |
javassist AlmaLinux:8 | All versions | 3.18.1-8.module_el8.5.0+2577+9e95fe00 |
javassist-javadoc AlmaLinux:8 | All versions | 3.18.1-8.module_el8.5.0+2577+9e95fe00 |
pki-servlet-engine AlmaLinux:8 | All versions | 1:9.0.62-1.module_el8.10.0+3791+e0637953 |
relaxngDatatype AlmaLinux:8 | All versions | 2011.1-7.module_el8.5.0+2577+9e95fe00 |
slf4j AlmaLinux:8 | All versions | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
slf4j-jdk14 AlmaLinux:8 | All versions | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
stax-ex AlmaLinux:8 | All versions | 1.7.7-8.module_el8.5.0+2577+9e95fe00 |
velocity AlmaLinux:8 | All versions | 1.7-24.module_el8.5.0+2577+9e95fe00 |
xalan-j2 AlmaLinux:8 | All versions | 2.7.1-38.module_el8.5.0+2577+9e95fe00 |
xerces-j2 AlmaLinux:8 | All versions | 2.11.0-34.module_el8.5.0+2577+9e95fe00 |
xml-commons-apis AlmaLinux:8 | All versions | 1.4.01-25.module_el8.5.0+2577+9e95fe00 |
xml-commons-resolver AlmaLinux:8 | All versions | 1.2-26.module_el8.5.0+2577+9e95fe00 |
xmlstreambuffer AlmaLinux:8 | All versions | 1.5.4-8.module_el8.5.0+2577+9e95fe00 |
xsom AlmaLinux:8 | All versions | 0-19.20110809svn.module_el8.5.0+2577+9e95fe00 |
pki-jackson-annotations AlmaLinux:9 | All versions | 2.19.1-1.el9_6 |
pki-jackson-core AlmaLinux:9 | All versions | 2.19.1-1.el9_6 |
pki-jackson-databind AlmaLinux:9 | All versions | 2.19.1-1.el9_6 |
pki-jackson-jaxrs-json-provider AlmaLinux:9 | All versions | 2.19.1-1.el9_6 |
How do I fix CVE-2025-52999?
Upgrade com.fasterxml.jackson.core:jackson-core to 2.15.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-52999 being exploited?
There is no known exploitation of CVE-2025-52999 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALSA-2025:12280, ALSA-2025:14126, CLEANSTART-2026-FL97476, CLEANSTART-2026-FY33285, CLEANSTART-2026-SP08423, CLEANSTART-2026-UR77351 and 40 more.