GHSA-h46c-h94j-95f3

    Dashboard / Vulnerabilities / GHSA-h46c-h94j-95f3

    GHSA-h46c-h94j-95f3

    Published: 27 Jun 2025Last Modified: 10 Sept 2026

    Summary: jackson-core can throw a StackoverflowError when processing deeply nested data

    Details: ### Impact With older versions of jackson-core, if you parse an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. ### Patches jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. Change is in https://github.com/FasterXML/jackson-core/pull/943. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. ### Workarounds Users should avoid parsing input files from untrusted sources.

    References: https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3, https://nvd.nist.gov/vuln/detail/CVE-2025-52999, https://github.com/FasterXML/jackson-core/pull/943, https://github.com/FasterXML/jackson-core

    Affected packages

    Package

    Name: com.fasterxml.jackson.core:jackson-core

    Purl: pkg:maven/com.fasterxml.jackson.core/jackson-core

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.15.0

    Affected versions

    2.0.0
    2.0.0-RC1
    2.0.0-RC2
    2.0.0-RC3
    2.0.1
    2.0.2
    2.0.4
    2.0.5
    2.0.6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-h46c-h94j-95f3 | CVE-DB