Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-23T21:00:20 jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-1050

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.

This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Cryostat 4 Not affected jackson-databind OpenShift Developer Tools and Services Affected jenkins OpenShift Developer Tools and Services Affected jenkins-2-plugins OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel8 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-ekb-dispatcher-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-ekb-receiver-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-cuda-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-gaudi-rhel9 Red Hat AMQ Broker 7 Affected jackson-databind Red Hat AMQ Clients Affected jackson-databind Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/de-minimal-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/de-supported-rhel9 Red Hat Ansible Automation Platform 2 Not affected python3.11-drools-jpy-jar Red Hat Ansible Automation Platform 2 Not affected python3.12-drools-jpy-jar Red Hat Ansible Automation Platform 2 Not affected python3x-drools-jpy-jar Red Hat Ansible Automation Platform 2 Not affected python-drools-jpy-jar Red Hat build of Apache Camel 4 for Quarkus 3 Not affected jackson-databind Red Hat build of Apache Camel for Spring Boot 4 Affected jackson-databind Red Hat build of Apache Camel - HawtIO 4 Affected jackson-databind Red Hat build of Apicurio Registry 3 Not affected jackson-databind Red Hat build of Debezium 3 Will not fix jackson-databind Red Hat Build of Keycloak Affected jackson-databind Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9 Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9-operator Red Hat Build of Keycloak Affected rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Build of Keycloak Affected rhbk-rhel9-operator/rhbk-rhel9-operator Red Hat build of Quarkus Not affected jackson-databind Red Hat Certificate System 10 Affected redhat-pki:10/redhat-pki Red Hat Data Grid 8 Affected jackson-databind Red Hat Enterprise Linux 10 Not affected dogtag-pki Red Hat Enterprise Linux 8 Not affected pki-core Red Hat Enterprise Linux 9 Not affected jackson-jaxrs-providers Red Hat Enterprise Linux 9 Not affected jackson-modules-base Red Hat Enterprise Linux 9 Not affected pki-core Red Hat Enterprise Linux 9 Not affected resteasy Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat JBoss Enterprise Application Platform 7 Affected eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Affected eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Affected eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Affected jackson-databind Red Hat JBoss Enterprise Application Platform 7 Affected jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Affected jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 8 Not affected jackson-databind Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected jackson-databind Red Hat Lightspeed for Runtimes Operator Affected rh-lightspeed-runtimes/runtimes-agent-init-rhel9 Red Hat Offline Knowledge Portal Not affected offline-knowledge-portal/rhokp-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-modelmesh-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-vllm-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/multicluster-redirector-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/pluginregistry-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/server-rhel9 Red Hat Satellite 6 Not affected candlepin Red Hat Satellite 6 Affected openvox-server Red Hat Satellite 6 Affected puppetserver Red Hat Satellite 6 Not affected satellite:el8/candlepin Red Hat Satellite 6 Affected satellite:el8/puppetserver Red Hat Single Sign-On 7 Affected jackson-databind streams for Apache Kafka 2 Affected jackson-databind streams for Apache Kafka 3 Affected jackson-databind https://www.cve.org/CVERecord?id=CVE-2026-50193 https://nvd.nist.gov/vuln/detail/CVE-2026-50193 https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c https://github.com/FasterXML/jackson-databind/issues/3447 https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh