CVE-2026-50193

Katalog CVE

CVSS 7.5 · High EPSS 0,62%

Kerentanan Uncontrolled Resource Consumption pada fasterxml jackson-databind. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

27 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh patch · advisory vendor
• https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c patch
• https://github.com/FasterXML/jackson-databind/issues/3447 exploit · issue tracking