CVE-2026-86513
MediumCVSS 5.3Summary
A vulnerability in java-json-tools jackson-coreutils 2.0 affects the TreePointer.tokensFromInput function in src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java in the JSON Pointer parser component. Manipulation results in resource allocation. The attack can be executed remotely, and the exploit has been released publicly. The project has not responded to the issue report.
Risk Assessment
Resource allocation may lead to memory or other resource exhaustion, potentially causing denial of service (DoS).
Recommendation
Monitor vendor patch announcements and restrict access to services using jackson-coreutils to trusted sources.
Other vulnerabilities in jackson-coreutils
See all- CVE-2026-86511Medium
A vulnerability in java-json-tools jackson-coreutils 2.0 affects the BigDecimal.toPlainString function in src/main/java/com/github/fge/jackson/JacksonUtils.java. Manipulation results in resource consumption. The attack may be initiated remotely, and the exploit has been made public. The project has not responded to the issue report.
- CVE-2026-86321Medium
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java of the component JSON Pointer parser. The manipulation results in allocation of resources. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.