Is there a patch available for CVE-2026-50193?

Yes, a patch is available for CVE-2026-50193. Update the affected software to the latest version immediately.

jackson-databind CVE-2026-50193

Q: What is the CVSS score of CVE-2026-50193?

CVE-2026-50193 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-38597 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-06-23 security-advisories@github.com

GHSA-3wrr-7qpf-2prh

Denial Of Service Jackson Databind Red Hat

6.3

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

AC:H reflects the required non-default code path (readTree plus toString); only availability is impacted via uncontrolled StackOverflowError under concurrent load.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 23, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jun 23, 2026 - 21:32 vuln.today

Analysis Generated

Jun 23, 2026 - 21:32 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7,611 maven packages depend on com.fasterxml.jackson.core:jackson-databind (2,137 direct, 5,569 indirect)

Ecosystem-wide dependent count for version 2.10.0.

DescriptionCVE.org

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.

AnalysisAI

Uncontrolled resource consumption in jackson-databind 2.10.0 through 2.13.5 allows unauthenticated remote attackers to cause a Denial-of-Service by submitting small (~2kB), deeply nested JSON payloads that trigger a StackOverflowError when a service reads the input via ObjectMapper.readTree() and serializes the resulting JsonNode using JsonNode.toString(). The root cause is recursive serialization in the toString() call path, which was replaced with an iterative IteratorStack-based implementation in version 2.14.0. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.

Technical ContextAI

jackson-databind (Maven coordinate com.fasterxml.jackson.core:jackson-databind) is the data-binding and tree-model component of the FasterXML Jackson JSON library, one of the most widely used JSON processing libraries on the JVM. The vulnerability falls under CWE-400 (Uncontrolled Resource Consumption). The underlying mechanism is recursive call-stack growth during JsonNode serialization: when ObjectMapper.readTree() constructs a deeply nested JsonNode tree from JSON input, a subsequent call to JsonNode.toString() internally invokes recursive serialize() calls - one stack frame per nesting level. At roughly 1,000 levels of nesting (achievable with a 2kB payload), the JVM default thread stack is exhausted, triggering an unchecked java.lang.StackOverflowError. The fix (commit a1fa4ae4ecf5cee16da465985f135f3e81816f8c) replaces the recursive traversal in InternalNodeMapper with an iterative loop backed by a custom IteratorStack data structure, eliminating the stack-depth dependency entirely.

RemediationAI

Upgrade jackson-databind to version 2.14.0 or later, which replaces the recursive JsonNode serialization with an iterative implementation and fully resolves the vulnerability; this is confirmed by commit a1fa4ae4ecf5cee16da465985f135f3e81816f8c and the GHSA advisory at https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh. If an immediate upgrade is not feasible, the vendor-documented workaround is to replace all calls to JsonNode.toString() used for output with ObjectMapper.writeValueAsString(node), which uses a non-recursive serialization path and is therefore not vulnerable; this requires a targeted code change at every call site where toString() is used for producing JSON strings rather than for debugging. As an additional compensating control, deploying a JSON depth limit at the API gateway or framework layer - for example, configuring Jackson's StreamReadConstraints.maxNestingDepth() introduced in 2.15 - can reject excessively nested payloads before they reach the vulnerable path, with the trade-off that legitimate deeply-nested inputs would also be rejected.