6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50193

CVE-2026-50193: jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50193

CVE-2026-50193:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.fasterxml.jackson.core:jackson-databind	maven	>= 2.10.0, <= 2.13.5	2.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service caused by a StackOverflowError when serializing a deeply nested JsonNode to a string. The root cause lies in the com.fasterxml.jackson.databind.node.InternalNodeMapper$NonRecursiveSerializer._serializeNonRecursive method, which, despite its name, used a recursive approach for serialization. When a user calls the toString() method on a JsonNode (defined in com.fasterxml.jackson.databind.node.BaseJsonNode), it triggers this serialization process. For each level of nesting in the JSON object, the _serializeNonRecursive method would call value.serialize(), which would in turn call back into the same serialization logic, creating a new frame on the call stack. With thousands of nesting levels, this exhausts the stack space, leading to a StackOverflowError and crashing the thread. The patch corrects this by replacing the recursive calls with a truly iterative, stack-based implementation that manages an explicit stack of iterators to traverse the JSON tree, thus avoiding deep recursion on the call stack.

Vulnerable functions

com.fasterxml.jackson.databind.node.InternalNodeMapper$NonRecursiveSerializer._serializeNonRecursive

src/main/java/com/fasterxml/jackson/databind/node/InternalNodeMapper.java

This method was responsible for serializing a JsonNode. Despite its name, the original implementation was indirectly recursive. When serializing an ObjectNode or ArrayNode, it would iterate over its children and call `value.serialize(g, _context)` on each child. If a child was also an ObjectNode or ArrayNode, this would result in a recursive call, leading to a `StackOverflowError` when processing deeply nested JSON structures. The `toString()` method on a `JsonNode` triggers this serialization process.

com.fasterxml.jackson.databind.node.BaseJsonNode.toString

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.