CVE-2025-52999
BaseFortify
Publication date: 2025-06-25
Last updated on: 2025-06-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in jackson-core versions prior to 2.15.0, where parsing JSON input files with very deeply nested data structures can cause a StackoverflowError due to excessive recursion depth. The parser did not limit how deep it would traverse nested JSON, leading to potential crashes. The issue was fixed in version 2.15.0 by adding a configurable maximum nesting depth limit (default 1000). If this limit is exceeded, jackson-core throws a StreamConstraintsException instead of crashing. [1]
How can this vulnerability impact me? :
If you parse JSON input files with very deeply nested structures using vulnerable versions of jackson-core, your application could crash due to a StackoverflowError. This can lead to denial of service or instability in your system. The vulnerability can be exploited by sending maliciously crafted JSON inputs with excessive nesting depth. Using jackson-core 2.15.0 or later mitigates this by enforcing a nesting depth limit and throwing an exception instead of crashing. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for errors related to JSON parsing of deeply nested input files, specifically looking for StackoverflowError or StreamConstraintsException in logs when processing JSON data with jackson-core versions prior to 2.15.0. Since the issue arises from parsing deeply nested JSON, you can test by attempting to parse JSON files with nesting depth greater than 1000 and observe if a StackoverflowError occurs (indicating vulnerable versions) or a StreamConstraintsException is thrown (indicating patched versions). There are no specific network commands provided, but you can use application-level logging and JSON parsing tests to detect the issue. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading jackson-core to version 2.15.0 or later, which introduces a configurable maximum nesting depth limit (default 1000) to prevent stack overflow errors. Additionally, avoid parsing JSON input files from untrusted sources to reduce risk. If upgrading is not immediately possible, implement input validation to reject or limit deeply nested JSON structures before parsing. [1, 2]