Read the docs
TI-2025-33004 Aliases CVE-2025-52999GHSA-h46c-h94j-95f3

jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data

Priority MEDIUM 45CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 33 fixed, 15 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-121 and the CVSS impact.

Summary

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00772 55th percentileScored 2026-11-07
Fix Partial jackson-core (FasterXML): 2.15.0com.fasterxml.jackson.core:jackson-core (Maven): 2.15.0Red Hat: 28 advisoriesRed Hat: 33 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FasterXMLjackson-corebefore 2.15.02.15.0Patch availableCNA
—com.fasterxml.jackson.core:jackson-core (Maven)before 2.15.02.15.0Patch availableGHSA-h46c-h94j-95f3
  • jackson-core VendorFasterXML Affected before 2.15.0 Fixed in 2.15.0 Patch available CNA
  • com.fasterxml.jackson.core:jackson-core (Maven) Vendor— Affected before 2.15.0 Fixed in 2.15.0 Patch available GHSA-h46c-h94j-95f3

Remediation

  • Fix · CNA jackson-core (FasterXML) Fixed in 2.15.0
  • Fix · GHSA-h46c-h94j-95f3 com.fasterxml.jackson.core:jackson-core (Maven) Fixed in 2.15.0 Advisory →

Red Hat 28 advisories

  • RHSA-2026:4917 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el9eap +40
  • RHSA-2026:4915 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el7eap +42
  • RHSA-2026:4916 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el8eap +43
Show 25 more Red Hat advisories
  • RHSA-2026:0743 Released 2026-01-19 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.3.16 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jackson-annotations-2.10.4-4.redhat_00008.1.el7eap, eap7-jackson-core-2.10.4-4.redhat_00008.1.el7eap, eap7-jackson-databind-2.10.4-6.redhat_00008.1.el7eap +38
  • RHSA-2026:0742 Released 2026-01-19 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.1.13 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jackson-annotations-2.8.11-2.redhat_00004.1.ep7.el7, eap7-jackson-core-2.8.11-3.redhat_00004.1.ep7.el7, eap7-jackson-datatype-jdk8-2.8.11-2.redhat_00004.1.ep7.el7 +11
  • RHSA-2025:17189 Released 2025-10-01 · Red Hat rating Important
    Logging for Red Hat OpenShift - 5.8.22
    • Logging for Red Hat OpenShift 5.8 registry.redhat.io/openshift-logging/elasticsearch6-rhel9
  • RHSA-2025:15847 Released 2025-09-15 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.23.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/machineexec-rhel9 +3
  • RHSA-2025:15717 Released 2025-09-11 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.12 security update
    • Red Hat Single Sign-On 7.6.12
  • RHSA-2025:14127 Released 2025-08-20 · Red Hat rating Important
    pki-deps:10.6 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2025:14126 Released 2025-08-20 · Red Hat rating Important
    pki-deps:10.6 security update
    • Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.10.0+20993+d0f024b0.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.10.0+20993+d0f024b0.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.10.0+20993+d0f024b0.noarch::pki-deps:10.6 +47
  • RHSA-2025:14118 Released 2025-08-20 · Red Hat rating Important
    pki-deps:10.6 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2025:14117 Released 2025-08-20 · Red Hat rating Important
    pki-deps:10.6 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2025:14116 Released 2025-08-20 · Red Hat rating Important
    pki-deps:10.6 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2025:12280 Released 2025-07-30 · Red Hat rating Important
    jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream (v. 9) jackson-annotations-2.19.1-1.el9_6, jackson-core-2.19.1-1.el9_6, jackson-databind-2.19.1-1.el9_6 +8
  • RHSA-2025:12281 Released 2025-07-30 · Red Hat rating Important
    jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) jackson-annotations-2.19.1-1.el9_4, jackson-core-2.19.1-1.el9_4, jackson-databind-2.19.1-1.el9_4 +8
  • RHSA-2025:12283 Released 2025-07-30 · Red Hat rating Important
    jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) jackson-annotations-2.19.1-1.el9_0, jackson-core-2.19.1-1.el9_0, jackson-databind-2.19.1-1.el9_0 +8
  • RHSA-2025:12282 Released 2025-07-30 · Red Hat rating Important
    jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) jackson-annotations-2.19.1-1.el9_2, jackson-core-2.19.1-1.el9_2, jackson-databind-2.19.1-1.el9_2 +8
  • RHSA-2025:11473 Released 2025-07-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jackson-annotations-2.12.7-2.redhat_00004.1.el7eap, eap7-jackson-core-2.12.7-2.SP1_redhat_00001.1.el7eap, eap7-jackson-databind-2.12.7-2.redhat_00004.1.el7eap +13
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jackson-annotations-2.12.7-2.redhat_00004.1.el8eap, eap7-jackson-core-2.12.7-2.SP1_redhat_00001.1.el8eap, eap7-jackson-databind-2.12.7-2.redhat_00004.1.el8eap +14
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-jackson-annotations-2.12.7-2.redhat_00004.1.el9eap, eap7-jackson-core-2.12.7-2.SP1_redhat_00001.1.el9eap, eap7-jackson-databind-2.12.7-2.redhat_00004.1.el9eap +14
  • RHSA-2025:11474 Released 2025-07-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 security update
    • Red Hat JBoss Enterprise Application Platform 7.4.24 com.fasterxml.jackson.core.jackson-core-2.12.7.SP1-redhat-00001.jar
  • RHSA-2025:10120 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1750903529-1.el8, jenkins-2.504.2.1750903189-3.el8
  • RHSA-2025:10118 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1750933270-1.el8, jenkins-2.504.2.1750932984-3.el8
  • RHSA-2025:10119 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1750916671-1.el8, jenkins-2.504.2.1750916374-3.el8
  • RHSA-2025:10104 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.15 jenkins-2-plugins-4.15.1750856638-1.el8, jenkins-2.504.2.1750856366-3.el8
  • RHSA-2025:10098 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.16 jenkins-2-plugins-4.16.1750857315-1.el9, jenkins-2.504.2.1750857144-3.el9
  • RHSA-2025:10097 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.17 jenkins-2-plugins-4.17.1750851950-1.el9, jenkins-2.504.2.1750851690-3.el9
  • RHSA-2025:10092 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.18 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.18 jenkins-2-plugins-4.18.1750846854-1.el9, jenkins-2.504.2.1750846524-3.el9
  • RHSA-2025:3465 Released 2025-04-01 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.21 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-netty-4.1.119-1.Final_redhat_00004.1.el7eap, eap7-netty-all-4.1.119-1.Final_redhat_00004.1.el7eap, eap7-netty-buffer-4.1.119-1.Final_redhat_00004.1.el7eap +29
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-netty-4.1.119-1.Final_redhat_00004.1.el8eap, eap7-netty-all-4.1.119-1.Final_redhat_00004.1.el8eap, eap7-netty-buffer-4.1.119-1.Final_redhat_00004.1.el8eap +30
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-netty-4.1.119-1.Final_redhat_00004.1.el9eap, eap7-netty-buffer-4.1.119-1.Final_redhat_00004.1.el9eap, eap7-netty-codec-4.1.119-1.Final_redhat_00004.1.el9eap +29
  • RHSA-2025:3467 Released 2025-04-01 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.21 security update
    • Red Hat JBoss Enterprise Application Platform com.fasterxml.jackson.core.jackson-core-2.12.7.SP1-redhat-00001.jar, commons-beanutils.commons-beanutils-1.11.0.redhat-00001.jar, io.netty.netty-common-4.1.124.Final-redhat-00001.jar +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix planned: Will not fix
Red Hat Data Grid 8AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix planned: Will not fix
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
streams for Apache KafkaAffectedNo fix planned: Will not fix
streams for Apache Kafka 2AffectedNo fix yet
Logging for Red Hat OpenShift 5.8Fixed RHSA-2025:17189
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2025:10118
OpenShift Developer Tools and Services for OCP 4.13Fixed RHSA-2025:10119
OpenShift Developer Tools and Services for OCP 4.14Fixed RHSA-2025:10120
OpenShift Developer Tools and Services for OCP 4.15Fixed RHSA-2025:10104
OpenShift Developer Tools and Services for OCP 4.16Fixed RHSA-2025:10098
OpenShift Developer Tools and Services for OCP 4.17Fixed RHSA-2025:10097
OpenShift Developer Tools and Services for OCP 4.18Fixed RHSA-2025:10092
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:14126
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:12280
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2025:14127
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:14116
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:14118
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:14118
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:14117
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:12283
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:12282
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:12281
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2025:14116
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:14118
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:14117
Red Hat JBoss EAP 7.4 ELS for RHEL 7 ServerFixed RHSA-2026:4915
Red Hat JBoss EAP 7.4 ELS for RHEL 8Fixed RHSA-2026:4916
Red Hat JBoss EAP 7.4 ELS for RHEL 9Fixed RHSA-2026:4917
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2025:11473, RHSA-2025:3465
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2025:11473, RHSA-2025:3465
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2025:11473, RHSA-2025:3465
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2025:3467
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2026:0742
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2026:0743
Red Hat JBoss Enterprise Application Platform 7.4.24Fixed RHSA-2025:11474
Red Hat OpenShift Dev Spaces (RHOSDS) 3.23Fixed RHSA-2025:15847
Red Hat Single Sign-On 7.6.12Fixed RHSA-2025:15717
Not affected: 26 products
  • Cryostat 4
  • Logging for Red Hat OpenShift 5.8
  • OpenShift Serverless
  • Red Hat AMQ Clients
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ceph Storage 6
  • Red Hat Ceph Storage 7
  • Red Hat Ceph Storage 8
  • Red Hat Certificate System 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 ELS for RHEL 8
  • Red Hat JBoss EAP 7.4 ELS for RHEL 9
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform 7.4.24
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23
  • Red Hat Satellite 6
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-52999
  2. 2026-10-03 Alias added: GHSA-h46c-h94j-95f3

References

Advisory 1

Other 3

  • TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
  • TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
  • TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
  • TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences