Answer in brief
CVE-2026-50193 records a High severity (CVSS 7.5) security vulnerability in jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString(). The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Answer in brief
CVE-2026-50193 records a High severity (CVSS 7.5) security vulnerability in jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString(). The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Update com.fasterxml.jackson.core:jackson-databind to 2.14.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-50193 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databindmaven | >=2.10.0,<=2.13.5 | 2.14.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-50193 records a High severity (CVSS 7.5) security vulnerability in jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString(). The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for com.fasterxml.jackson.core:jackson-databind.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate com.fasterxml.jackson.core:jackson-databind to 2.14.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-50193 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databindmaven | >=2.10.0,<=2.13.5 | 2.14.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-50193 records a High severity (CVSS 7.5) security vulnerability in jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString(). The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for com.fasterxml.jackson.core:jackson-databind.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard### Impact Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service: 1. Reads deeply nested (1000s of levels) JSON as `JsonNode` (ObjectMapper.readTree()) 2. Writes out same (or modifided) node using `JsonNode.toString()` which can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). ### Patches Fixed in 2.14.0 via https://github.com/FasterXML/jackson-databind/issues/3447. ### Workarounds Avoid serializing `JsonNode` using `toString()`: use ObjectMapper.writeValueAsString(node)
### Impact Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service: 1. Reads deeply nested (1000s of levels) JSON as `JsonNode` (ObjectMapper.readTree()) 2. Writes out same (or modifided) node using `JsonNode.toString()` which can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). ### Patches Fixed in 2.14.0 via https://github.com/FasterXML/jackson-databind/issues/3447. ### Workarounds Avoid serializing `JsonNode` using `toString()`: use ObjectMapper.writeValueAsString(node)