What is CVE-2025-52999?

CVE-2025-52999 is a vulnerability in Fasterxml Jackson-core, classified under Stack-based Buffer Overflow. Published 2025-06-25.

Is CVE-2025-52999 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Fasterxml Jackson-core

CVE-2025-52999

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end u…

Vulnerability class: Buffer Overflow

EPSS: 0.006 (46.7th percentile) — read the EPSS interpretation.

Affected products

Fasterxml Jackson-core — versions < 2.15.0

Weakness classification (CWE)

CWE-121 — Stack-based Buffer Overflow

Public proof-of-concept exploits

sassoftware/jackson

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-52999?: CVE-2025-52999 is a vulnerability in Fasterxml Jackson-core, classified under Stack-based Buffer Overflow. Published 2025-06-25.
Is CVE-2025-52999 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.