ECHO-0701-e1ec-3081

See a problem?
Import Source
https://advisory.echohq.com/osv/ECHO-0701-e1ec-3081.json
JSON Data
https://api.test.osv.dev/v1/vulns/ECHO-0701-e1ec-3081
Upstream
Withdrawn
2026-11-04T11:30:10Z
Published
2026-09-30T11:25:20Z
Modified
2026-11-04T17:24:12Z
Summary
StackOverflowError from JsonNode.toString() on deeply nested trees. The fix (commit a1fa4ae4e, issue #3447: InternalNodeMapper serializes JsonNode trees without recursion, with DeepJsonNodeSerTest) is already in 2.14.0-rc2; it first shipped in 2.14.0-rc1 (`git merge-base --is-ancestor a1fa4ae4e jackson-databind-2.14.0-rc2` succeeds). The advisory's patched version is 2.14.0 and its affected range ends at 2.13.5; trivy flags this pre-release only because 2.14.0-rc2 sorts below 2.14.0.
Details
References

Affected packages

Echo:Maven / com.fasterxml.jackson.core:jackson-databind

Package

Name
com.fasterxml.jackson.core:jackson-databind
Purl
pkg:maven/com.fasterxml.jackson.core/jackson-databind

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.14.0-rc2+echo.1

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-0701-e1ec-3081.json"