FasterXML Jackson EUVD-2026-102127

Exploitation requires that the application deserialize attacker-controlled JSON through Jackson 1.x's ObjectMapper.readValue (or an equivalent read path) with no enforced input nesting-depth limit - which is the default behavior of the affected jackson-mapper-asl 1.8.3 and 1.9.2-1.9.13 releases. The limiting factors are deployment-specific rather than configuration flags: the vulnerable code path is only reachable if the endpoint accepts untrusted JSON (not internally generated data), and the affected product is the end-of-life Jackson 1.x branch, so modern Jackson 2.x stacks (which enforce StreamReadConstraints depth limits by default) are not affected. No authentication, special feature toggle, or non-default setting is needed beyond exposing the JSON parse path to external input.

All exploitability signals point to a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity, network-reachable attack with no user interaction, and the impact profile is C:N/I:N/A:H - a pure denial-of-service via stack exhaustion (CWE-674) with no confidentiality or integrity loss. This caps severity at 7.5 (High) rather than Critical. There is no CISA KEV entry and no EPSS score supplied, so there is no evidence of active exploitation; likewise no public exploit code is referenced, meaning this is 'no public exploit identified at time of analysis.' The risk is therefore real for any service that feeds untrusted JSON through Jackson 1.x ObjectMapper.readValue, but it is a process/thread crash, not a code-execution or data-breach primitive, and triggering it is trivial (a deeply nested JSON document). One tempering factor is product age: Jackson 1.x (jackson-mapper-asl, codehaus namespace) is end-of-life, so exposure depends on legacy deployments rather than current stacks. Net: a legitimate availability priority for exposed legacy Java services, but lower urgency than its 7.5 suggests given no exploitation telemetry and a crash-only impact.

An attacker sends an HTTP request carrying a JSON body consisting of thousands of nested arrays or objects (e.g. '[[[[...]]]]') to an endpoint that deserializes untrusted input with Jackson 1.x ObjectMapper.readValue. The recursive descent parser exhausts the thread's stack, throwing StackOverflowError and crashing the worker thread or the application, denying service to legitimate users. No authentication or user interaction is required, and no public proof-of-concept is referenced in the provided data.