CVE-2026-29062
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In jackson-core versions 3.0.0 through 3.1.0, the UTF8DataInputJsonParser and ReaderBasedJsonParser bypass the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. This allows an attacker to supply a deeply nested JSON document, causing a StackOverflowError and Denial of Service (DoS). The issue is fixed in version 3.1.0.
Risk Assessment
The organization is vulnerable to DoS attacks that can crash applications processing JSON data, leading to service disruptions and potential financial losses.
Recommendation
Immediately update jackson-core to version 3.1.0 or later, which includes the fix for this vulnerability.
Other vulnerabilities in jackson-core
See all- CVE-2026-68494High
The fix for CVE-2026-18401 in jackson-core is incomplete and leaves a bypass in the non-blocking parser. An attacker can stream JSON in small chunks without a terminator, causing unbounded buffer growth limited only by maxStringLength (20 MiB) instead of maxNumberLength (1000).
- CVE-2026-18401Medium
The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint (default: 1000 characters) defined in StreamReadConstraints. An attacker can submit a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service (DoS). The issue affects jackson-core versions 2.15.0–2.18.5 and 2.19.0–2.21.0, as well as tools.jackson.core 3.0.0–3.0.x.
Original NVD description (English source)
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.