CVE-2026-50193High· 7.5▾ Twilight

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing (CVE-2026-50193)

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 23, 2026

Updated

Oct 19, 2026

CVSS

7.5

Vendor

Red Hat

Product

Red Hat JBoss EAP 7.4 ELS for RHEL 8

CWE

CWE-1050, CWE-400

Depth score

41 · Moderate

EPSS

0.62% · p49

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Aug 1.

0.5% → 0.6%▲ 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

10 events · 118 days

Jun 23, 2026Published
Disclosed via CSAF
Aug 1, 2026EPSS first tracked
0.5%
Aug 24, 2026EPSS peak
0.5% → 0.6%
Sep 8, 2026CVSS changed
— → 7.5
Sep 8, 2026Severity changed
medium → high
Sep 8, 2026CVSS changed
7.5 → —
Sep 8, 2026Severity changed
high → medium
Sep 8, 2026CVSS changed
— → 7.5
Sep 8, 2026Severity changed
medium → high
Oct 19, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-1050 CWE-400 #csaf #vex #red-hat #ghsa #maven

Affected

Patched in

jboss_eap_7_4_els_for_rhel_7_server
single_sign_on_7_6_for_rhel_7_server
jboss_eap_7_4_els_for_rhel 8
middleware_containers_for_openshift
single_sign_on_7_6_for_rhel 8
jboss_eap_7_4_els_for_rhel 9
single_sign_on_7_6_for_rhel 9
openshift_developer_tools_and_services 4.12
openshift_developer_tools_and_services 4.13
openshift_developer_tools_and_services 4.14
openshift_developer_tools_and_services 4.15
openshift_developer_tools_and_services 4.16
openshift_developer_tools_and_services 4.17
openshift_developer_tools_and_services 4.18
openshift_developer_tools_and_services 4.19
openshift_developer_tools_and_services 4.20
openshift_developer_tools_and_services 4.21
openshift_developer_tools_and_services 4.22
ai_inference_server 3.2
data_grid 8.6.2
jboss_enterprise_application_platform 7.4.25
lightspeed_formerly_insights_for_runtimes 1.0
openshift_ai 2.25
openshift_ai 3.4
openshift_dev_spaces 3.29
openshift_dev_spaces 3.30
single_sign_on 7.6.13
build_of_apache_camel_4_18_3_for_spring_boot 3.5.16
streams_for_apache_kafka 3.2.1

Full technical detail▾

Overview

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.

Vendor advisories

RHSA-2026:53644 · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server · released 2026-08-11 · advisory
RHSA-2026:76128 · Red Hat · fixed in: Red Hat Single Sign-On 7.6 for RHEL 7 Server · released 2026-10-06 · advisory
RHSA-2026:53645 · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 8 · released 2026-08-11 · advisory
RHSA-2026:76134 · Red Hat · fixed in: Middleware Containers for OpenShift · released 2026-10-05 · advisory
RHSA-2026:76129 · Red Hat · fixed in: Red Hat Single Sign-On 7.6 for RHEL 8 · released 2026-10-06 · advisory
RHSA-2026:53646 · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 9 · released 2026-08-11 · advisory
RHSA-2026:76130 · Red Hat · fixed in: Red Hat Single Sign-On 7.6 for RHEL 9 · released 2026-10-06 · advisory
RHSA-2026:60247 · Red Hat · fixed in: OpenShift Developer Tools and Services 4.12 · released 2026-08-26 · advisory
RHSA-2026:60249 · Red Hat · fixed in: OpenShift Developer Tools and Services 4.13 · released 2026-08-26 · advisory
RHSA-2026:60248 · Red Hat · fixed in: OpenShift Developer Tools and Services 4.14 · released 2026-08-26 · advisory
RHSA-2026:60239 · Red Hat · fixed in: OpenShift Developer Tools and Services 4.15 · released 2026-08-26 · advisory
Red Hat VEX · Important · affected: OpenShift Developer Tools and Services, OpenShift Serverless, Red Hat AI Inference Server, Red Hat AMQ Broker 7, Red Hat AMQ Clients, Red Hat build of Apache Camel - HawtIO 4, … · no fix planned: Red Hat AI Inference Server, Red Hat build of Debezium 3, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · updated 2026-10-19 · vex
RHSA-2026:60251 · Red Hat · fixed in: OpenShift Developer Tools and Services 4.16 · released 2026-08-26 · advisory
RHSA-2026:60246 · Red Hat · fixed in: OpenShift Developer Tools and Services 4.17 · released 2026-08-26 · advisory
RHSA-2026:60250 · Red Hat · fixed in: OpenShift Developer Tools and Services 4.18 · released 2026-08-26 · advisory
RHSA-2026:60252 · Red Hat · fixed in: OpenShift Developer Tools and Services 4.19 · released 2026-08-26 · advisory
RHSA-2026:60259 · Red Hat · fixed in: OpenShift Developer Tools and Services 4.20 · released 2026-08-26 · advisory
RHSA-2026:60254 · Red Hat · fixed in: OpenShift Developer Tools and Services 4.21 · released 2026-08-26 · advisory
RHSA-2026:60256 · Red Hat · fixed in: OpenShift Developer Tools and Services 4.22 · released 2026-08-26 · advisory

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing — rated Important by Red Hat. Released 2026-06-23, updated 2026-10-19.

Affected:

OpenShift Developer Tools and Services
OpenShift Serverless
Red Hat AI Inference Server
Red Hat AMQ Broker 7
Red Hat AMQ Clients
Red Hat build of Apache Camel - HawtIO 4
Red Hat build of Debezium 3
Red Hat Certificate System 10
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat JBoss Enterprise Application Platform 7
Red Hat OpenShift AI (RHOAI)
Red Hat Satellite 6
streams for Apache Kafka 2

Fixed:

Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server
Red Hat Single Sign-On 7.6 for RHEL 7 Server
Red Hat JBoss EAP 7.4 ELS for RHEL 8
Middleware Containers for OpenShift
Red Hat Single Sign-On 7.6 for RHEL 8
Red Hat JBoss EAP 7.4 ELS for RHEL 9
Red Hat Single Sign-On 7.6 for RHEL 9
OpenShift Developer Tools and Services 4.12
OpenShift Developer Tools and Services 4.13
OpenShift Developer Tools and Services 4.14
OpenShift Developer Tools and Services 4.15
OpenShift Developer Tools and Services 4.16
OpenShift Developer Tools and Services 4.17
OpenShift Developer Tools and Services 4.18
OpenShift Developer Tools and Services 4.19
OpenShift Developer Tools and Services 4.20
OpenShift Developer Tools and Services 4.21
OpenShift Developer Tools and Services 4.22
Red Hat AI Inference Server 3.2
Red Hat Data Grid 8.6.2
Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat Lightspeed (formerly Insights) for Runtimes 1.0
Red Hat OpenShift AI 2.25
Red Hat OpenShift AI 3.4
Red Hat OpenShift Dev Spaces 3.29
Red Hat OpenShift Dev Spaces 3.30
Red Hat Single Sign-On 7.6.13
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
Streams for Apache Kafka 3.2.1

No fix planned:

Red Hat AI Inference Server
Red Hat build of Debezium 3
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat OpenShift AI (RHOAI)
OpenShift Developer Tools and Services
OpenShift Serverless
Red Hat AMQ Broker 7
Red Hat AMQ Clients
Red Hat build of Apache Camel - HawtIO 4
Red Hat Certificate System 10
Red Hat JBoss Enterprise Application Platform 7
Red Hat Satellite 6
streams for Apache Kafka 2

Not affected:

OpenShift Developer Tools and Services 4.12
OpenShift Developer Tools and Services 4.13
OpenShift Developer Tools and Services 4.14
OpenShift Developer Tools and Services 4.15
OpenShift Developer Tools and Services 4.16
OpenShift Developer Tools and Services 4.17
OpenShift Developer Tools and Services 4.18
OpenShift Developer Tools and Services 4.19
OpenShift Developer Tools and Services 4.20
OpenShift Developer Tools and Services 4.21

Remediation

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:53644 Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:76128 Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:53645

Workarounds / mitigations:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Package advisory (CVE-2026-50193)

Affected packages:

com.fasterxml.jackson.core:jackson-databind >= 2.10.0, <= 2.13.5

Patched in:

com.fasterxml.jackson.core:jackson-databind 2.14.0

Source: https://github.com/advisories/GHSA-3wrr-7qpf-2prh

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026CVSS — → 7.5
Sep 8, 2026Severity medium → high
Sep 8, 2026CVSS 7.5 → —
Sep 8, 2026Severity high → medium
Sep 8, 2026CVSS — → 7.5
Sep 8, 2026Severity medium → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#ghsa#maven

← Back to feed