Junglewise Threat Intelligence

CVE-2026-29062: FasterXML jackson-core DoS via nesting depth limit bypass

CVE-2026-29062 · Severity: high · CVSS 7.5 · Published 2026-03-06

Executive brief

FasterXML jackson-core is a widely used Java library for processing JSON data. A vulnerability in certain versions allows an attacker to crash an application by sending a specially crafted JSON file with deeply nested structures. This can lead to a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.

Technical details

A vulnerability exists in jackson-core versions 3.0.0 through 3.0.x where the UTF8DataInputJsonParser and ReaderBasedJsonParser components bypass the 'maxNestingDepth' constraint (default 500) defined in StreamReadConstraints. By providing a JSON document with excessive nesting, a remote, unauthenticated attacker can trigger a StackOverflowError during processing. This leads to a Denial of Service (DoS) by crashing the JVM thread or the entire application. The issue is a regression or incomplete application of previous fixes (like CVE-2025-52999) to the 3.x branch. The vulnerability is addressed in version 3.1.0.

Affected products

  • FasterXML jackson-core >= 3.0.0, < 3.1.0

Timeline

  • 2026-02-19: patched: Fix merged into 3.x branch via pull request 1554.
  • 2026-03-03: advisory: GitHub Security Advisory GHSA-6v53-7c9g-w56r published.
  • 2026-03-06: disclosed: CVE-2026-29062 published to NVD.

References

Related threats