CVE-2025-52999

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.

• CWE-121

• https://github.com/FasterXML/jackson-core/pull/943
• https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3

Published

Jun 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52993A race condition in the Nix, Lix, and Guix package managers …5.6
• CVE-2025-52994gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.…4.9
• CVE-2025-52995File Browser provides a file managing interface within a spe…6.6
• CVE-2025-52996File Browser provides a file managing interface within a spe…4.3
• CVE-2025-52997File Browser provides a file managing interface within a spe…7.5
• CVE-2025-52998Chamilo is a learning management system. Prior to version 1.…9.8
• CVE-2025-53000The nbconvert tool, jupyter nbconvert, converts Jupyter note…7.8
• CVE-2025-53001Rejected reason: Reason: This candidate was issued in error.
• CVE-2025-53002LLaMA-Factory is a tuning library for large language models.…9.8
• CVE-2025-53003The Janssen Project is an open-source identity and access ma…8.2
• CVE-2025-53004DataEase is an open source business intelligence and data vi…9.8
• CVE-2025-53005DataEase is an open source business intelligence and data vi…9.8