jackson-databind EUVD-2026-38597

Exploitation requires that the target application uses two specific Jackson API calls in sequence on attacker-controlled input: ObjectMapper.readTree() to parse the JSON into a JsonNode tree, and JsonNode.toString() to serialize that node back to a string. Both conditions must be present in the same code path; services that deserialize into POJOs, or that serialize via ObjectMapper.writeValueAsString(), are not affected. The deeply nested structure must reach thousands of nesting levels; typical JSON payloads at normal business depths do not trigger the issue. There is no authentication requirement per the CVSS PR:N metric, so any unauthenticated endpoint exercising this pattern is exposed. Limiting factors include: the specific readTree() + toString() pattern must exist in application code reachable from the attacker; Jackson 2.14.0 or the writeValueAsString() workaround fully eliminates the vulnerability without restricting input depth.

The CVSS 4.0 base score of 6.3 (Medium) reflects the conditional nature of the attack: the AT:P (Attack Requirements: Present) metric captures the prerequisite that the target service must use the specific readTree() + toString() code path. Network reachability and zero-authentication requirements (AV:N/PR:N) increase the exposure surface once a vulnerable endpoint is identified. Real-world risk is moderate - the vulnerable pattern is not the only way to use Jackson, but it is common in services that accept arbitrary JSON and pass it through JsonNode for logging, debugging, or downstream forwarding. The availability impact is constrained to the service threads processing the malicious request; sustained concurrent requests can however saturate thread pools. No EPSS data was provided in the input. No CISA KEV listing and no public exploit code is known at time of analysis, which significantly reduces urgency versus an actively exploited vulnerability. A version-range discrepancy exists between the CVE description (2.13.0 as lower bound) and the GHSA package metadata (>= 2.10.0); both ranges should be treated as potentially applicable until resolved with the vendor.

An attacker identifies a REST endpoint that accepts arbitrary JSON, internally processes it with ObjectMapper.readTree(), and emits the result or logs it via JsonNode.toString(). The attacker submits concurrent HTTP requests each carrying a ~2kB payload of approximately 1,000 levels of nested arrays. Each request triggers a StackOverflowError in the processing thread; under sustained load, this exhausts the service thread pool and degrades or halts availability. No public exploit code exists at time of analysis, but the attack is straightforward to replicate given the detailed public description and the small payload size required.