Jackson Core and Jackson Databind Stack Overflow Vulnerability Due to Deeply Nested Data

A vulnerability in Jackson Core prior to version 2.15.0 allows for a StackOverflowError to be thrown when parsing deeply nested data. This issue arises because the parser does not have a limit on how deep it can traverse, leading to stack overflow in cases of excessive nesting. Jackson Databind, which relies on Jackson Core for JSON parsing, is also affected. The vulnerability can be exploited by parsing untrusted input files with complex nested structures.

Impact

Exploitation of this vulnerability can lead to a StackOverflowError, causing a denial of service by crashing the application.

Remediation

Users can upgrade to Jackson Core version 2.15.0 or later, which introduces a configurable limit on nesting depth, defaulting to 1000. Jackson Databind users should also upgrade to versions that include this fix.