CVE-2026-95155
7.5HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-674
Impact
Remote, unauthenticated attackers can crash your service via denial of service. They only need to send deeply nested JSON payloads to endpoints that deserialize data with ObjectMapper.readValue.
Root cause
Uncontrolled recursion during deserialization of deeply nested JSON input exhausts stack space (CWE-674), triggering a crash.
Affected systems
FasterXML Jackson 1.x (jackson-mapper-asl), confirmed in 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to a maintained major version (Jackson 2.x) as 1.x is end-of-life and no patch is specified. As an interim mitigation, reject deeply nested payloads or limit incoming JSON document size at the reverse proxy or API gateway before deserialization.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue.