CVE-2026-86511
MediumCVSS 5.3Summary
A vulnerability in java-json-tools jackson-coreutils 2.0 affects the BigDecimal.toPlainString function in src/main/java/com/github/fge/jackson/JacksonUtils.java. Manipulation results in resource consumption. The attack may be initiated remotely, and the exploit has been made public. The project has not responded to the issue report.
Risk Assessment
Resource consumption may lead to system resource exhaustion, potentially causing denial of service (DoS).
Recommendation
Monitor vendor patch announcements and restrict access to services using jackson-coreutils to trusted sources.
Other vulnerabilities in jackson-coreutils
See all- CVE-2026-86513Medium
A vulnerability in java-json-tools jackson-coreutils 2.0 affects the TreePointer.tokensFromInput function in src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java in the JSON Pointer parser component. Manipulation results in resource allocation. The attack can be executed remotely, and the exploit has been released publicly. The project has not responded to the issue report.
- CVE-2026-86321Medium
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consumption. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.