GHSA-6v53-7c9g-w56r

Suggest an improvement
Source
https://github.com/advisories/GHSA-6v53-7c9g-w56r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-6v53-7c9g-w56r/GHSA-6v53-7c9g-w56r.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-6v53-7c9g-w56r
Aliases
Downstream
CGA (22)
MINI (7)
Published
2026-03-04T21:23:45Z
Modified
2026-07-17T21:11:25Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
Details

Summary

The UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints.

A similar issue was found in ReaderBasedJsonParser.

This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS).

The related fix for com.fasterxml.jackson.core:jackson-core, CVE-2025-52999, was not fully applied to tools.jackson.core:jackson-core until the 3.1.0 release. It is recommended that 3.0.x users upgrade.

Patches

jackson-core contains a configurable limit for how deep Jackson will traverse in an input document. This check was missing in a few places in tools.jackson.core:jackson-core.

The change is in https://github.com/FasterXML/jackson-core/pull/1554. jackson-core will throw a StreamConstraintsException if the limit is reached.

jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs.

Workarounds

Users should avoid parsing input files from untrusted sources.

Resources

GHSA-6v53-7c9g-w56r https://nvd.nist.gov/vuln/detail/CVE-2025-52999 https://github.com/FasterXML/jackson-core/pull/1554

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-04T21:23:45Z",
    "nvd_published_at": "2026-03-06T08:16:26Z",
    "severity": "HIGH"
}
References

Affected packages

Maven / tools.jackson.core:jackson-core

Package

Name
tools.jackson.core:jackson-core
View open source insights on deps.dev
Purl
pkg:maven/tools.jackson.core/jackson-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.1.0

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0-rc1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-6v53-7c9g-w56r/GHSA-6v53-7c9g-w56r.json"