CVE-2026-95155
Received Received - Intake

Denial of Service in FasterXML Jackson

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: MITRE

Description
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-95155
EUVD
EUVD-2026-102127

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves FasterXML Jackson 1.x library versions, specifically jackson-mapper-asl 1.8.3 through 1.9.13. Attackers can exploit it by sending deeply nested JSON data to an application using ObjectMapper.readValue for deserialization. This causes a denial of service by overwhelming system resources.

Impact Analysis

If you use affected Jackson versions in your application, an attacker could send maliciously crafted JSON data to crash your service. This leads to downtime, disrupted services, and potential loss of availability for your application and its users.

Mitigation Strategies

Upgrade Jackson libraries to versions that address this issue. Avoid deserializing untrusted JSON input. Use input validation and limit nesting depth in JSON parsing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95155. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart