Is CVE-2026-29062 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29062 being exploited in the wild.

How severe is CVE-2026-29062?

High severity, with a CVSS score of 7.5, published 6 March 2026.

Which products and versions are affected?

tools.jackson.core:jackson-core (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.0.

Is there a fix for CVE-2026-29062?

Yes. tools.jackson.core:jackson-core (Maven): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-29062 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-29062?

Check whether you run FasterXML Jackson-Core or tools.jackson.core:jackson-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29062: FasterXML jackson-core DoS via nesting depth limit bypass

CVE-2026-29062 · Severity: high · CVSS 7.5 · Published 2026-03-06

FasterXML jackson-core is a widely used Java library for processing JSON data. A vulnerability in certain versions allows an attacker to crash an application by sending a specially crafted JSON file with deeply nested structures. This can lead to a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.

Technologies: FasterXML Jackson-Core, tools.jackson.core:jackson-core (Maven). Vendors: FasterXML, Maven.

Quick answers

Is CVE-2026-29062 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29062 being exploited in the wild.
How severe is CVE-2026-29062?: High severity, with a CVSS score of 7.5, published 6 March 2026.
Which products and versions are affected?: tools.jackson.core:jackson-core (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.0.
Is there a fix for CVE-2026-29062?: Yes. tools.jackson.core:jackson-core (Maven): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29062 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-29062?: Check whether you run FasterXML Jackson-Core or tools.jackson.core:jackson-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tools.jackson.core:jackson-core (Maven): upgrade to 3.1.0 or later

# set tools.jackson.core:jackson-core to 3.1.0 in your pom.xml or build.gradle

Technical details

A vulnerability exists in jackson-core versions 3.0.0 through 3.0.x where the UTF8DataInputJsonParser and ReaderBasedJsonParser components bypass the 'maxNestingDepth' constraint (default 500) defined in StreamReadConstraints. By providing a JSON document with excessive nesting, a remote, unauthenticated attacker can trigger a StackOverflowError during processing. This leads to a Denial of Service (DoS) by crashing the JVM thread or the entire application. The issue is a regression or incomplete application of previous fixes (like CVE-2025-52999) to the 3.x branch. The vulnerability is addressed in version 3.1.0.

Affected products

FasterXML jackson-core >= 3.0.0, < 3.1.0

Identifiers

CVE-2026-29062
GHSA-6v53-7c9g-w56r

Timeline

2026-02-19: patched: Fix merged into 3.x branch via pull request 1554.
2026-03-03: advisory: GitHub Security Advisory GHSA-6v53-7c9g-w56r published.
2026-03-06: disclosed: CVE-2026-29062 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.