CVE-2026-95155: Maven/org.codehaus.jackson/jackson-mapper-asl vulnerability
Published Oct 15, 2026
·Updated
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue.
Affected Software
1 affected component
maven/org.codehaus.jackson/jackson-mapper-asl=1.8.3, =1.9.2, =1.9.11, =1.9.12, =1.9.13
Event History
Oct 15, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Which applications are exposed to this denial-of-service issue?
Applications using jackson-mapper-asl that deserialize untrusted JSON through ObjectMapper.readValue are exposed. The issue is confirmed in versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13.
2
What does an attacker need to exploit this issue?
An attacker needs to be able to supply JSON input that the application passes to ObjectMapper.readValue. The malicious input uses deep JSON nesting to cause a denial of service.