Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-50193 Denial-of-Service via Deeply Nested JSON in jackson-databind 2.13.0-2.14.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50193
Post summary
A denial-of-service vulnerability (CVE-2026-50193) affecting jackson-databind through deeply nested JSON was disclosed for versions 2.13.0-2.14.0.
🟠 Jackson-databind, Denial-of-Service (StackOverflowError), #CVE-2026-50193 (Moderate Severity) -DC-Jun2026-602 https://dailycve.com/jackson-databind-denial-of-service-stackoverflowerror-cve-2026-50193-moderate-severity-dc-jun2026-602/
Post summary
The post serves as a brief disclosure of CVE‑2026‑50193, noting the affected component, vulnerability type, and severity, but provides no exploit, patch, or active‑exploitation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fasterxml | jackson-databind | - | - | - |