CVE-2025-52999

Overview

Jackson Core is the foundational package of the Jackson project that provides low-level, incremental (“streaming”) parser and generator abstractions used by the Jackson Data Processor. While it includes default implementations for handling JSON, the core abstractions themselves are not JSON-specific, even though many names reference JSON for historical reasons. This package serves as the base for the Jackson data-binding module and is also extended by alternate data format implementations such as Smile (binary JSON), XML, CSV, Protobuf, and CBOR.

‍

A Denial of Service (DoS) vulnerability (CVE-2025-52999) has been identified in Jackson Core. Deeply nested data can lead to Stack Overflow Error during processing. This issue could be exploited by attackers to crash applications relying on Jackson Core, resulting in service disruption.

‍

Per CISA: A denial-of-service (DoS) attack occurs when legitimate users are unable to access information systems, devices, or other network resources due to the actions of a malicious cyber threat actor. Services affected may include email, websites, online accounts (e.g., banking), or other services that rely on the affected computer or network. A denial-of-service condition is accomplished by flooding the targeted host or network with traffic until the target cannot respond or simply crashes, preventing access for legitimate users. DoS attacks can cost an organization both time and money while their resources and services are inaccessible.

‍

Details

Module Info

• Product: Jackson Core
• Affected packages: jackson-core
• Affected versions: <2.15.0
• GitHub repository: https://github.com/FasterXML/jackson-core
• Published packages: https://central.sonatype.com/artifact/com.fasterxml.jackson.core/jackson-core
• Package manager: Maven
• Fixed In: NES for Jackson Core v2.13.6

‍

Vulnerability Info

Jackson Core contained a vulnerability where extremely deep nesting in input documents could cause the parser to exhaust the Java stack and throw a StackOverflowError, allowing an attacker to disrupt service by sending specially crafted input. Versions prior to 2.15.0 are affected because they did not enforce a traversal-depth limit. The issue was addressed in jackson-core 2.15.0, which introduces a configurable maximum depth (default 1000) and causes the parser to fail fast with a StreamConstraintsException when that limit is exceeded. Because Jackson Databind relies on Jackson Core for parsing, it also benefits from this fix.

‍

Mitigation

Only recent versions of Jackson Core are community-supported. Only the recent community supported version will receive updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to supported versions of Jackson Core >=2.15.0 and tune the depth limit to match your application’s expected input complexity.
• Avoid parsing untrusted or unauthenticated input and validate or pre-sanitize inputs for abnormal nesting.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.