This vulnerability occurs when the UTF8DataInputJsonParser component in jackson-core bypasses the configured maximum nesting depth (default 500). An attacker can supply a JSON document with arbitrarily deep nesting, causing the parser to recurse until a StackOverflowError occurs. The resulting exception can crash the application, leading to a denial of service. The underlying weakness matches the CWE identifiers for resource exhaustion and out‑of‑bounds logic.

FasterXML’s jackson-core library, versions 3.0.0 through 3.0.x (any patch release prior to 3.1.0), is affected. The issue was resolved in release 3.1.0, so any deployment using a pre‑3.1.0 jar is vulnerable. Applications that embed jackson-core directly or via dependency chains may be impacted.

The CVSS base score of 8.7 classifies this as a high‑severity weakness. The EPSS indicates a probability of exploitation below 1 %, suggesting that while the flaw is unlikely to be commonly exploited, it remains a serious risk in targeted or high‑value scenarios. The vulnerability is not listed in the KEV catalog, so no known widespread active exploitation is reported. Based on the description, it is inferred that an attacker can trigger the DoS by sending a deeply nested JSON payload to any component that employs the unpatched parser, typically via exposed web services or file input endpoints.