Unknown · Jackson-Core · CVE-2025-52999
Name of the Vulnerable Software and Affected Versions:
jackson-core versions prior to 2.15.0
Description:
The issue arises when parsing input files with deeply nested data, potentially causing a StackoverflowError due to excessive depth. A configurable limit for traversal depth has been introduced, defaulting to 1000, to prevent this error. If the limit is reached, a StreamConstraintsException is thrown. Users should avoid parsing input files from untrusted sources as a workaround.
Recommendations:
For versions prior to 2.15.0, update to version 2.15.0 or later to include the configurable depth limit and prevent StackoverflowError.
As a temporary workaround, consider avoiding the parsing of deeply nested input files from untrusted sources until the update is applied.