Skip to content
Fencer Vulns
high 8.7

CVE-2025-52999 json

jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data

published 2025-06-25 16 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-28482 , GHSA-h46c-h94j-95f3

cvss
8.7
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.

Patch / fix

  • maven com.fasterxml.jackson.core:jackson-core 2.15.0
  • com.fasterxml.jackson.core jackson-core 2.15.0
  • fasterxml jackson-core 2.15.0
  • jackson-core Debian 12 2.14.1-2~deb12u1
  • jackson-core Debian 13 2.14.1-2~deb13u1
  • jackson-core Debian 14 2.14.1-2

debian advisories DEBIAN-CVE-2025-52999

  • xsom RHEL 8 0-19.20110809svn.module+el8.10.0+20993+d0f024b0
  • slf4j RHEL 8 1.7.25-4.module+el8.10.0+20993+d0f024b0
  • stax-ex RHEL 8 1.7.7-8.module+el8.10.0+20993+d0f024b0
  • bea-stax RHEL 8 1.2.0-16.module+el8.10.0+20993+d0f024b0
  • velocity RHEL 8 1.7-24.module+el8.10.0+20993+d0f024b0
  • xalan-j2 RHEL 8 2.7.1-38.module+el8.10.0+20993+d0f024b0
  • javassist RHEL 8 3.18.1-8.module+el8.10.0+20993+d0f024b0
  • xerces-j2 RHEL 8 2.11.0-34.module+el8.10.0+20993+d0f024b0

red hat advisories RHSA-2026:4916RHSA-2026:4917RHSA-2026:4915RHSA-2026:0742RHSA-2026:0743RHSA-2025:14127

  • xsom AlmaLinux 8 0-19.20110809svn.module_el8.5.0+2577+9e95fe00
  • slf4j AlmaLinux 8 1.7.25-4.module_el8.5.0+2577+9e95fe00
  • stax-ex AlmaLinux 8 1.7.7-8.module_el8.5.0+2577+9e95fe00
  • velocity AlmaLinux 8 1.7-24.module_el8.5.0+2577+9e95fe00
  • xalan-j2 AlmaLinux 8 2.7.1-38.module_el8.5.0+2577+9e95fe00
  • javassist AlmaLinux 8 3.18.1-8.module_el8.5.0+2577+9e95fe00
  • xerces-j2 AlmaLinux 8 2.11.0-34.module_el8.5.0+2577+9e95fe00
  • jackson-bom AlmaLinux 8 2.19.1-1.module_el8.10.0+4034+20822525

almalinux advisories ALSA-2025:14126ALSA-2025:12280

  • jackson-modules-base Rocky Linux 9 2.19.1-1.el9_6
  • jackson-core Rocky Linux 9 2.19.1-1.el9_6
  • jackson-databind Rocky Linux 9 2.19.1-1.el9_6
  • jackson-annotations Rocky Linux 9 2.19.1-1.el9_6
  • jackson-jaxrs-providers Rocky Linux 9 2.19.1-1.el9_6
  • xsom Rocky Linux 8 0-19.20110809svn.module+el8.10.0+1763+c7c02164
  • xsom Rocky Linux 8 0-19.20110809svn.module+el8.10.0+2052+1b0fb438
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.10.0+2052+1b0fb438

rocky linux advisories RLSA-2025:12280RLSA-2025:14126

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-52999 updated cvss 7.5

com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError

  • Red Hat AMQ Broker 7 jackson-core
    affected: workaround, no fix planned “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.”
  • Red Hat build of Apicurio Registry 2 jackson-core Red Hat build of Apicurio Registry 3 jackson-core
    affected: workaround, no fix available “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.”
  • Red Hat build of Debezium 2 jackson-core Red Hat build of Debezium 3 jackson-core Red Hat build of OptaPlanner 8 jackson-core
    affected: workaround, no fix planned “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.”
  • Red Hat Data Grid 8 jackson-core
    affected: workaround, no fix available “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.”
  • Red Hat Enterprise Linux 8 resteasy, resteasy-javadoc Red Hat Enterprise Linux 9 resteasy, pki-resteasy-core, pki-resteasy-client, pki-resteasy-jackson2-provider, pki-resteasy-servlet-initializer Red Hat Fuse 7 jackson-core Red Hat Integration Camel K 1 jackson-core Red Hat OpenShift Dev Spaces devspaces/server-rhel8
    affected: workaround, no fix planned “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.”
  • Red Hat Process Automation 7 jackson-core
    affected: workaround, no fix available “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.”
  • Red Hat streams for Apache Kafka jackson-core
    affected: workaround, no fix planned “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.”
  • Red Hat streams for Apache Kafka 2 jackson-core
    affected: workaround, no fix available “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.”
show 24 more
  • Red Hat Logging for Red Hat OpenShift 5.8 openshift-logging
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:17189
  • Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.504.2.1750932984-3.el8, jenkins-2-plugins 4.12.1750933270-1.el8
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:10118
  • Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins 2.504.2.1750916374-3.el8, jenkins-2-plugins 4.13.1750916671-1.el8
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:10119
  • Red Hat OpenShift Developer Tools and Services for OCP 4.14 jenkins 2.504.2.1750903189-3.el8, jenkins-2-plugins 4.14.1750903529-1.el8
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:10120
  • Red Hat OpenShift Developer Tools and Services for OCP 4.15 jenkins 2.504.2.1750856366-3.el8, jenkins-2-plugins 4.15.1750856638-1.el8
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:10104
  • Red Hat OpenShift Developer Tools and Services for OCP 4.16 jenkins 2.504.2.1750857144-3.el9, jenkins-2-plugins 4.16.1750857315-1.el9
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:10098
  • Red Hat OpenShift Developer Tools and Services for OCP 4.17 jenkins 2.504.2.1750851690-3.el9, jenkins-2-plugins 4.17.1750851950-1.el9
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:10097
  • Red Hat OpenShift Developer Tools and Services for OCP 4.18 jenkins 2.504.2.1750846524-3.el9, jenkins-2-plugins 4.18.1750846854-1.el9
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:10092
  • Red Hat Enterprise Linux AppStream (v. 8) slf4j 1.7.25-4.module+el8.10.0+20993+d0f024b0, stax-ex 1.7.7-8.module+el8.10.0+20993+d0f024b0, velocity 1.7-24.module+el8.10.0+20993+d0f024b0, bea-stax 1.2.0-16.module+el8.10.0+20993+d0f024b0, xalan-j2 2.7.1-38.module+el8.10.0+20993+d0f024b0, javassist 3.18.1-8.module+el8.10.0+20993+d0f024b0, +30 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:14126
  • Red Hat Enterprise Linux AppStream (v. 9) jackson-core 2.19.1-1.el9_6, jackson-databind 2.19.1-1.el9_6, pki-jackson-core 2.19.1-1.el9_6, jackson-annotations 2.19.1-1.el9_6, jackson-modules-base 2.19.1-1.el9_6, pki-jackson-databind 2.19.1-1.el9_6, +5 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:12280
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +33 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:14127
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:14116
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more Red Hat Enterprise Linux AppStream E4S (v.8.6) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:14118
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +33 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:14117
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) jackson-core 2.19.1-1.el9_0, jackson-databind 2.19.1-1.el9_0, pki-jackson-core 2.19.1-1.el9_0, jackson-annotations 2.19.1-1.el9_0, jackson-modules-base 2.19.1-1.el9_0, pki-jackson-databind 2.19.1-1.el9_0, +5 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:12283
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) jackson-core 2.19.1-1.el9_2, jackson-databind 2.19.1-1.el9_2, pki-jackson-core 2.19.1-1.el9_2, jackson-annotations 2.19.1-1.el9_2, jackson-modules-base 2.19.1-1.el9_2, pki-jackson-databind 2.19.1-1.el9_2, +5 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:12282
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) jackson-core 2.19.1-1.el9_4, jackson-databind 2.19.1-1.el9_4, pki-jackson-core 2.19.1-1.el9_4, jackson-annotations 2.19.1-1.el9_4, jackson-modules-base 2.19.1-1.el9_4, pki-jackson-databind 2.19.1-1.el9_4, +5 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:12281
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:14116
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +34 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:14118
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, bea-stax 1.2.0-16.module+el8.1.0+3366+6dfb954c, xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c, javassist 3.18.1-8.module+el8.1.0+3366+6dfb954c, +33 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:14117
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-javadocs 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-java-jdk8 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-java-jdk11 7.4.24-4.GA_redhat_00002.1.el7eap
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2026:4915
  • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-javadocs 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-java-jdk8 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-java-jdk11 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-java-jdk17 7.4.24-4.GA_redhat_00002.1.el8eap
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2026:4916
  • Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-javadocs 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-java-jdk8 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-java-jdk11 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-java-jdk17 7.4.24-4.GA_redhat_00002.1.el9eap
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2026:4917
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.23-4.GA_redhat_00003.1.el7eap, eap7-netty 4.1.119-1.Final_redhat_00004.1.el7eap, eap7-jackson-core 2.12.7-2.SP1_redhat_00001.1.el7eap, eap7-jackson-databind 2.12.7-2.redhat_00004.1.el7eap, eap7-netty-all 4.1.119-1.Final_redhat_00004.1.el7eap, eap7-wildfly 7.4.21-3.GA_29548_redhat_00001.1.el7eap, +42 more
    fixed: vendor fix “To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep nested data structures; anything with a depth over 1000.” RHSA-2025:11473

8 more fixed, 26 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
16 mo ago

Exploit prediction

0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
maven com.fasterxml.jackson.core:jackson-core
<2.15.0
2.15.0

Affected products

  • FasterXML jackson-core

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.