CVE-2026-50193High· 7.5▾ TwilightA flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that rea…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.6%
— → 7.5
medium → high
7.5 → —
high → medium
— → 7.5
medium → high
Last analysed / modified upstream
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing — rated Important by Red Hat. Released 2026-06-23, updated 2026-09-17.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:53644 Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:53645 Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:53646
Workarounds / mitigations:
Affected packages:
com.fasterxml.jackson.core:jackson-databind >= 2.10.0, <= 2.13.5Patched in:
com.fasterxml.jackson.core:jackson-databind 2.14.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54512High· 8.1jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
CVE-2026-59885High· 7.5pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885)
CVE-2026-54060High· 7.5python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)
CVE-2026-48779High· 7.5ws is an open source WebSocket client and server for Node.js
CVE-2026-45822High· 7.5decode-uri-component: decode-uri-component: Denial of Service via crafted input (CVE-2026-45822)
CVE-2026-71491High· 7.5sqlparse is a non-validating SQL parser module for Python