Skip to main content

Stack-based Buffer Overflow in com.fasterxml.jackson.core:jackson-core

CVE-2025-52999

  • com.fasterxml.jackson.core:jackson-core
  • com.fasterxml.jackson.jr:jackson-jr-all
High
8.7/10

Summary

The jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0-rc1, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a `StackOverflowError` if the depth is particularly large. The jackson-core contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of `1000`. The jackson-core will throw a `StreamConstraintsException` if the limit is reached. The jackson-databind also benefits from this change because it uses jackson-core to parse `JSON` inputs. As a workaround, users should avoid parsing input files from untrusted sources.

  • LOW
  • NETWORK
  • NONE
  • NONE

CWE-121 - Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

References

Advisory Timeline

  • Published