CVE-2026-50193 jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
Attackers can cause denial of service by sending deeply nested JSON that triggers a stack overflow when converted to string.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50193?
CVE-2026-50193 is a medium-severity denial of service vulnerability in Fasterxml Jackson-Databind, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.
Weakness: CWE-400
Which versions are affected by CVE-2026-50193?
2 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-databind Maven | From 2.10.0 | 2.14.0 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.10.0 | 2.14.0 |
Products include Fasterxml Jackson-Databind.
How do I fix CVE-2026-50193?
Upgrade com.fasterxml.jackson.core:jackson-databind to 2.14.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-50193 being exploited?
There is no known exploitation of CVE-2026-50193 in the wild and no public exploit code.
Other vulnerabilities in Fasterxml Jackson-Databind
- CVE-2018-11307 Deserialization of Untrusted Data in jackson-databind
- CVE-2026-54512 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
- CVE-2026-54513 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
- CVE-2020-14060 Deserialization of untrusted data in Jackson Databind
- CVE-2021-46877 jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode
Sources
Also known as CLEANSTART-2026-QE48496, DEBIAN-CVE-2026-50193, ECHO-0701-e1ec-3081, GHSA-3wrr-7qpf-2prh, MINI-3j38-9539-qrfj, MINI-5r7g-r7q7-789q and 9 more.