The vulnerability resides in FasterXML Jackson 1.x. When an application deserializes untrusted JSON through ObjectMapper.readValue, an attacker can supply a JSON document with an arbitrary number of nested objects. This causes the deserialization engine to recurse deeply, exhausting memory or CPU resources and ultimately leading to a denial of service. The weakness is classified under CWE-674, which denotes unchecked loop or recursion.

Affected systems are applications that include Jackson mapper ASL versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13. These versions are used in many Java and Java‑EE projects; any software that incorporates them without input validation or version upgrade is at risk.

The CVSS score of 7.5 indicates high severity. The EPSS score is currently not available, but the lack of an EPSS entry does not preclude exploitation, especially since the vulnerability is remote via network JSON data. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to be able to deliver malicious JSON to the vulnerable application; the exploitation path is straightforward once the data is accepted by the ObjectMapper. Given the high impact and the ease of triggering a DoS, systems should treat this as a critical operational risk.