CVE-2026-95155
Deferred Deferred - Pending Action

Denial of Service in FasterXML Jackson

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: MITRE

Description
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-95155
EUVD
EUVD-2026-102127

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves FasterXML Jackson 1.x library versions, specifically jackson-mapper-asl 1.8.3 through 1.9.13. Attackers can exploit it by sending deeply nested JSON data to an application using ObjectMapper.readValue for deserialization. This causes a denial of service by overwhelming system resources.

Detection Guidance

To detect this vulnerability, monitor for StackOverflowError exceptions during JSON parsing operations. Test Jackson 1.x versions by sending deeply nested JSON inputs (e.g., 4000-level nested arrays) to applications using ObjectMapper.readValue. Check logs for java.lang.StackOverflowError or application crashes during deserialization of untrusted JSON.

Impact Analysis

If you use affected Jackson versions in your application, an attacker could send maliciously crafted JSON data to crash your service. This leads to downtime, disrupted services, and potential loss of availability for your application and its users.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing denial-of-service conditions through resource exhaustion. A StackOverflowError may disrupt service availability when parsing untrusted JSON inputs, potentially violating availability requirements under these regulations. Uncontrolled errors may also hinder logging and monitoring capabilities required for compliance.

Mitigation Strategies

Upgrade Jackson libraries to versions that address this issue. Avoid deserializing untrusted JSON input. Use input validation and limit nesting depth in JSON parsing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95155. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart