View all vulnerabilities

CVE-2025-52999

jackson-core can throw a StackoverflowError when processing deeply nested data

### ImpactWith older versions  of jackson-core, if you parse an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large.### Patchesjackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. Change is in https://github.com/FasterXML/jackson-core/pull/943. jackson-core will throw a StreamConstraintsException if the limit is reached.jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs.### WorkaroundsUsers should avoid parsing input files from untrusted sources.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
8.5
Score Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Versions
com.fasterxml.jackson.core:jackson-core < 2.15.0
Severity
High
Ecosystem
Publish Date
June 27, 2025
Modified Date
June 27, 2025