CVE-2026-86321
MediumCVSS 5.3Summary
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Risk Assessment
The risk is the possibility of making unauthorized requests to internal network resources, which could lead to data leakage or privilege escalation.
Recommendation
It is recommended to immediately restrict access to the JsonLoader.fromURL function, apply an allowlist of URLs, and monitor network traffic for suspicious requests.
Other vulnerabilities in jackson-coreutils
See all- CVE-2026-86513Medium
A vulnerability in java-json-tools jackson-coreutils 2.0 affects the TreePointer.tokensFromInput function in src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java in the JSON Pointer parser component. Manipulation results in resource allocation. The attack can be executed remotely, and the exploit has been released publicly. The project has not responded to the issue report.
- CVE-2026-86511Medium
A vulnerability in java-json-tools jackson-coreutils 2.0 affects the BigDecimal.toPlainString function in src/main/java/com/github/fge/jackson/JacksonUtils.java. Manipulation results in resource consumption. The attack may be initiated remotely, and the exploit has been made public. The project has not responded to the issue report.
Original NVD description (English source)
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.