CVE-2026-50193

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.13.0 through 2.13.x

Description A potential Denial-of-Service exists when a service reads deeply nested JSON (thousands of levels) as a JsonNode using the readTree() function of ObjectMapper and subsequently writes that node using the toString() function of JsonNode. This process can consume significant system resources through concurrent, relatively small requests.

Recommendations Update to version 2.14.0. As a temporary workaround, avoid serializing JsonNode using toString() and use ObjectMapper.writeValueAsString(node) instead.