jackson-core
CVE-2026-29062
HIGH
GHSA-6v53-7c9g-w56r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify endpoint accepting JSON input
-
DeliveryCraft deeply nested JSON payload
-
ExploitSubmit to UTF8DataInput/Reader parser
-
ExecutionBypass maxNestingDepth guard
-
PersistExhaust JVM stack (StackOverflowError)
-
ImpactCrash service / deny availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application parse attacker-controlled JSON using either UTF8DataInputJsonParser (i.e. parsing from a java.io.DataInput source) or ReaderBasedJsonParser (a Reader/character-stream source) on jackson-core 3.0.0-3.0.x; the attacker then supplies a JSON document nested beyond the 500-level maxNestingDepth default. No authentication, user interaction, or special privileges are needed (PR:N/UI:N) and the attack is network-reachable (AV:N). Limiting factors: the application must actually expose one of these two parser paths to untrusted input and must not impose an upstream request-size or depth cap; deployments that parse only trusted data, enforce edge-side body-size limits, or have already moved to 3.1.0 are not exploitable. |
| Impact | Signals are internally consistent and point to a real-but-bounded availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and impact is purely VA:H (availability) - confidentiality and integrity are untouched, matching a pure DoS. EPSS is very low (0.06%, 17th percentile) and the CVE is not in CISA KEV, indicating no observed mass exploitation; this is expected for a non-RCE crash bug that grants no data access or foothold. The practical priority depends on exposure: a public-facing service that parses untrusted JSON via the affected parsers is genuinely at risk of repeatable crashes, while internal/trusted-input deployments face little real risk. There is no SSVC decision record in the provided data, and no POC is referenced, so 'automatable' and exploit-maturity remain unconfirmed - though the trigger (a single oversized nested payload) is technically easy to produce. Note one scope caveat: exploitability requires the application to actually use UTF8DataInputJsonParser or ReaderBasedJsonParser on attacker-controllable input, so raw CVSS:N may overstate risk for services that hard-cap request size or only parse trusted data. |
| Exploit ScenarioDerived | An attacker sends a single unauthenticated HTTP request whose JSON body is an array or object nested several thousand levels deep (e.g. '[[[[...]]]]') to an endpoint backed by a Jackson 3.0.x parser. The maxNestingDepth guard is bypassed, the recursive parse exhausts the JVM stack, and a StackOverflowError crashes or destabilizes the worker thread or service. No POC is referenced in the available data, but the payload is trivial to generate and the request can be replayed to sustain the outage. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jun 30, 2026
Uncontrolled-recursion denial of service in FasterXML jackson-core 3.0.0 through 3.0.x lets a remote attacker crash JSON-processing services by submitting a deeply nested JSON document. The UTF8DataInputJsonParser (DataInput sources) and ReaderBasedJsonParser fail to enforce the StreamReadConstraints maxNestingDepth limit (default 500), so excessive nesting drives a StackOverflowError. No public exploit identified at time of analysis and EPSS is low (0.06%), but the bug is trivially triggerable against any service that parses untrusted JSON with these parsers; fixed in 3.1.0.
Earlier versions of this analysis (4)
Denial of service in FasterXML jackson-core 3.0.0 through 3.0.x lets remote attackers crash JSON-processing threads by submitting a deeply nested JSON document. The UTF8DataInputJsonParser (used for java.io.DataInput sources) and ReaderBasedJsonParser fail to enforce the maxNestingDepth limit (default 500) from StreamReadConstraints, so unbounded recursive context creation triggers a StackOverflowError. This is the 3.x reappearance of a constraint added for the 2.x line (CVE-2025-52999); no public exploit identified at time of analysis and EPSS risk is low (0.06%).
Denial of service in FasterXML jackson-core 3.0.0 through 3.0.x lets remote attackers crash JSON-processing applications by submitting deeply nested JSON. The UTF8DataInputJsonParser (used for java.io.DataInput sources) and ReaderBasedJsonParser fail to enforce the maxNestingDepth limit (default 500) from StreamReadConstraints, so excessive nesting triggers an uncaught StackOverflowError. Fixed in 3.1.0; an upstream fix and GitHub Security Advisory exist, but no public exploit is identified and EPSS is low (0.06%).
Denial of service in FasterXML jackson-core 3.0.0 through 3.0.x (before 3.1.0) allows remote attackers to crash applications by submitting a JSON document with excessive structural nesting. The UTF8DataInputJsonParser (used for java.io.DataInput sources) and ReaderBasedJsonParser fail to enforce the maxNestingDepth limit (default 500) from StreamReadConstraints, so deeply nested input triggers an uncatchable StackOverflowError. No public exploit identified at time of analysis, and EPSS is low (0.06%), but the flaw is trivially triggerable against affected default configurations.
Jackson-Core versions up to 3.1.0 is affected by allocation of resources without limits or throttling (CVSS 7.5).
RemediationAI
Vendor-released patch: 3.1.0 - upgrade jackson-core to 3.1.0 or later, which enforces maxNestingDepth in both UTF8DataInputJsonParser and ReaderBasedJsonParser; verify transitive pins so a framework BOM does not silently hold the library at 3.0.x. The fix is delivered in commit 8b25fd67f20583e75fb09564ce1eaab06cd5a902 / PR https://github.com/FasterXML/jackson-core/pull/1554, and details are in the advisory https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56r. If you cannot upgrade immediately, the most effective compensating control is to cap inbound request/body size at the edge (reverse proxy or API gateway) so deeply nested payloads cannot reach the parser - trade-off: legitimate large documents may be rejected, so size the limit to your real payloads. Where feasible, explicitly construct parsers with a tightened StreamReadConstraints maxNestingDepth and reject oversized inputs before parsing, and avoid feeding untrusted data through DataInput-backed parsing; note these controls do not fully substitute for the patch because the affected parsers ignore the constraint pre-3.1.0, so edge-side size/depth filtering is the reliable interim mitigation.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jackson is the de-facto JSON streaming and data-binding library for the Java ecosystem; jackson-core provides the low-level incremental parser/generator primitives beneath jackson-databind. To defend against abusive inputs, jackson-core 2.15+ introduced StreamReadConstraints, including a maxNestingDepth ceiling (default 500) that aborts parsing of pathologically nested structures. This CVE is a CWE-770 (resource allocation without limits/throttling) defect: in the 3.0.x line, two parser implementations - UTF8DataInputJsonParser, used when reading from a java.io.DataInput, and ReaderBasedJsonParser, used for character-stream (Reader) sources - never consult the maxNestingDepth guard, so nesting is bounded only by available JVM stack. Each nesting level consumes a stack frame during recursive structural processing, and once the stack is exhausted the JVM raises an unrecoverable StackOverflowError. The CPE cpe:2.3:a:fasterxml:jackson-core confirms the affected component is the core library itself, meaning any downstream consumer (including jackson-databind users) inherits the flaw.
Know when Jackson Core gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, low-complexity parsing of attacker JSON yields only availability loss via StackOverflowError, so A:H with C:N/I:N and no scope change.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
7DescriptionCVE.org
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.
Blast Radius
ecosystem impact- 400 maven packages depend on tools.jackson.core:jackson-core (74 direct, 326 indirect)
Ecosystem-wide dependent count for version 3.0.0.
Executive ViewAI
FasterXML jackson-core versions 3.0.0-3.0.x contain a remotely exploitable denial-of-service vulnerability affecting JSON-parsing services across the organization. Attackers can crash services by submitting maliciously nested JSON documents, risking service unavailability for applications relying on this library. Currently, no public exploitation has been identified; however, the vulnerability is trivially triggerable and widely exposed, requiring urgent patching.
Apply vendor patch: jackson-core 3.1.0
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Jackson Core
View allDenial of service in FasterXML jackson-core's non-blocking (async) JSON parser allows unauthenticated network attackers
Memory exhaustion in jackson-core's non-blocking async parser allows remote unauthenticated attackers to exhaust JVM hea
Heap exhaustion denial of service in FasterXML jackson-core 2.16.0 and later allows an unauthenticated remote attacker t
Denial of service in FasterXML jackson-core 2.8.0 and later: an unauthenticated remote attacker who can supply a malform
Exploit-DB