CVE catalog
CVE-2026-50193
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends d
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.62% · Oct 25, 2026
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | jackson-databind | sid | 2.22.4-1 | fixed |
| Debian | jackson-databind | forky | 2.18.11-1 | fixed |
| Debian | jackson-databind | trixie | 2.14.0+ds-1+deb13u1 | fixed |
| Debian | jackson-databind | trixie-security | 2.14.0+ds-1+deb13u1 | fixed |
| Debian | jackson-databind | bookworm | 2.14.0-1+deb12u1 | fixed |
| Debian | jackson-databind | bookworm-security | 2.14.0-1+deb12u1 | fixed |
| Cpe | jackson-databind | Not reported | 2.14.0 | fixed |
| Cpe | jackson-databind | Not reported | 2.14.0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | jackson-databind | source | sid | 2.14.0-1 | not yet assigned | Not reported | Not reported |
| Debian | jackson-databind | source | forky | 2.14.0-1 | not yet assigned | Not reported | Not reported |
| Debian | jackson-databind | source | trixie | 2.14.0-1 | not yet assigned | Not reported | Not reported |
| Debian | jackson-databind | source | bookworm | 2.14.0-1 | not yet assigned | Not reported | Not reported |
| Cpe | jackson-databind | cpe | Not reported | 2.14.0 | Not reported | Not reported | Not reported |
| Cpe | jackson-databind | cpe | Not reported | 2.14.0 | Not reported | NVD-CVE-2026-50193 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libjackson2-databind-java]Fixed
Source package: [jackson-databind]
Details (4)
2.14.0-1+deb12u1· all · bookwormFixed · Fixed:
2.14.0-1nvd · jackson-databind · debian · bookworm; nvd · jackson-databind · debian · 12
2.14.0-1+deb12u1· all · bookwormFixed · Fixed:
2.14.0-1nvd · jackson-databind · debian · bookworm; nvd · jackson-databind · debian · 12
2.14.0-1+deb12u1· all · bookworm-securityFixed · Fixed:
2.14.0-1nvd · jackson-databind · debian · bookworm; nvd · jackson-databind · debian · 12
2.14.0-1+deb12u1· all · bookworm-securityFixed · Fixed:
2.14.0-1nvd · jackson-databind · debian · bookworm; nvd · jackson-databind · debian · 12
[Debian 13 (Trixie)]
- [libjackson2-databind-java]Fixed
Source package: [jackson-databind]
Details (4)
2.14.0+ds-1+deb13u1· all · trixieFixed · Fixed:
2.14.0-1nvd · jackson-databind · debian · 13
2.14.0+ds-1+deb13u1· all · trixieFixed · Fixed:
2.14.0-1nvd · jackson-databind · debian · 13
2.14.0+ds-1+deb13u1· all · trixie-securityFixed · Fixed:
2.14.0-1nvd · jackson-databind · debian · 13
2.14.0+ds-1+deb13u1· all · trixie-securityFixed · Fixed:
2.14.0-1nvd · jackson-databind · debian · 13
Observed:
References
- [https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c]
- [https://github.com/FasterXML/jackson-databind/issues/3447]
- [https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-50193]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-50193]
- [https://security-tracker.debian.org/tracker/CVE-2026-50193]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50193.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2058.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]