CVE-2025-52999 is a stack-based buffer overflow vulnerability in jackson-core before version 2.15.0. The vulnerability arises from the parser's inability to handle extremely deeply nested input data, which can cause a StackOverflowError due to excessive recursion depth. The fix in 2.15.0 adds a configurable maximum depth limit to the parser, preventing unbounded recursion and throwing a StreamConstraintsException if the limit is reached. This mitigates the risk of stack overflow crashes during JSON parsing. jackson-databind is indirectly protected by this fix since it uses jackson-core for parsing.

Applications using jackson-core versions prior to 2.15.0 are vulnerable to denial of service via stack overflow when processing maliciously crafted deeply nested JSON input. This can cause application crashes and potential service disruption. There are no known exploits in the wild at this time.

Upgrade jackson-core to version 2.15.0 or later, which includes a configurable depth limit to prevent stack overflow errors. As a temporary workaround, avoid parsing JSON inputs from untrusted sources to reduce risk. No other official fixes or patches are indicated.