CVE-2026-50193

描述

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.

如何修補 CVE-2026-50193

要修補 CVE-2026-50193,請將受影響套件升級到下列已修補版本。

• —升級至 2.14.0 或更新版本

CVE-2026-50193 正在被利用嗎?

低 — EPSS 為 0.6%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 2.10.0, < 2.14.0

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-50193
• PATCHgithub.com/FasterXML/jackson-databind
• WEBgithub.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c
• WEBgithub.com/FasterXML/jackson-databind/issues/3447