Jackson had this problem a few months back, where someone reported a critical CVE against the project and broke builds all around the planet https://github.com/

Jackson had this problem a few months back, where someone reported a critical CVE against the project and broke builds all around the planet https://github.com/FasterXML/jackson-databind/issues/3972 https://github.com/FasterXML/jackson-databind/issues/3972 Basically the programmer (not the attacker) had to write code where an object contained itself HashMap<String,Object> map=new HashMap<>(); map.put("recursive",map); After this, Jackson would indeed stack overflow if you asked it to wrap the object to JSON. Then again, half the build-in Java functions (e.g. getting an object hashcode for the map object) also fail for a recursive structure. The issue remains open 3 months later, Mitre still thinks it's hella serious, and people have yet again learned to just ignore their CI warning about CVEs