CVE-2026-50193

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50193
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-50193.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-50193
Aliases
Downstream
Published
2026-06-23T21:00:20.444Z
Modified
2026-06-26T12:06:18.865556595Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
Details

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50193.json",
    "cwe_ids": [
        "CWE-400"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/fasterxml/jackson-databind

Affected ranges

Type
GIT
Repo
https://github.com/fasterxml/jackson-databind
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
a1eedfdeea46f2a8da0ed23f06e7e1d39050499b
Fixed
f7bff132b41a8b7303b604e04d4c89ecea402895
Fixed
a1fa4ae4ecf5cee16da465985f135f3e81816f8c
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.10.0"
        },
        {
            "fixed": "2.14.0"
        }
    ]
}

Affected versions

jackson-databind-2.*
jackson-databind-2.10.0
jackson-databind-2.11.0
jackson-databind-2.11.0.rc1
jackson-databind-2.12.0
jackson-databind-2.12.0-rc1
jackson-databind-2.12.0-rc2
jackson-databind-2.12.1
jackson-databind-2.13.0
jackson-databind-2.13.0-rc1
jackson-databind-2.13.0-rc2
jackson-databind-2.14.0-rc1
jackson-databind-2.14.0-rc2
jackson-databind-2.14.0-rc3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-50193.json"