# CVE-2026-29062: FasterXML jackson-core DoS via nesting depth limit bypass

Source: https://junglewise.ai/threats/cve-2026-29062-fasterxml-jackson-core-dos-via-nesting-depth-limit-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-06. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-29062 · Severity: high · CVSS 7.5 · Published 2026-03-06

FasterXML jackson-core is a widely used Java library for processing JSON data. A vulnerability in certain versions allows an attacker to crash an application by sending a specially crafted JSON file with deeply nested structures. This can lead to a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.

Technologies: [FasterXML Jackson-Core](https://junglewise.ai/threats/technologies/jackson-core), [tools.jackson.core:jackson-core (Maven)](https://junglewise.ai/threats/technologies/tools-jackson-core-jackson-core). Vendors: [FasterXML](https://junglewise.ai/threats/vendors/fasterxml), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-29062 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29062 being exploited in the wild.

**How severe is CVE-2026-29062?** High severity, with a CVSS score of 7.5, published 6 March 2026.

**Which products and versions are affected?** tools.jackson.core:jackson-core (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.0.

**Is there a fix for CVE-2026-29062?** Yes. tools.jackson.core:jackson-core (Maven): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-29062 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-29062?** Check whether you run FasterXML Jackson-Core or tools.jackson.core:jackson-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tools.jackson.core:jackson-core (Maven): upgrade to 3.1.0 or later

  ```sh
  # set tools.jackson.core:jackson-core to 3.1.0 in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability exists in jackson-core versions 3.0.0 through 3.0.x where the UTF8DataInputJsonParser and ReaderBasedJsonParser components bypass the 'maxNestingDepth' constraint (default 500) defined in StreamReadConstraints. By providing a JSON document with excessive nesting, a remote, unauthenticated attacker can trigger a StackOverflowError during processing. This leads to a Denial of Service (DoS) by crashing the JVM thread or the entire application. The issue is a regression or incomplete application of previous fixes (like CVE-2025-52999) to the 3.x branch. The vulnerability is addressed in version 3.1.0.

## Affected products

- FasterXML jackson-core >= 3.0.0, < 3.1.0

## Identifiers

- CVE-2026-29062
- GHSA-6v53-7c9g-w56r

## Timeline

- 2026-02-19: patched: Fix merged into 3.x branch via pull request 1554.
- 2026-03-03: advisory: GitHub Security Advisory GHSA-6v53-7c9g-w56r published.
- 2026-03-06: disclosed: CVE-2026-29062 published to NVD.

## References

- [https://github.com/FasterXML/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaab06cd5a902](https://github.com/FasterXML/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaab06cd5a902)
- [https://github.com/FasterXML/jackson-core/pull/1554](https://github.com/FasterXML/jackson-core/pull/1554)
- [https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56r](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56r)
- [https://access.redhat.com/security/cve/CVE-2026-29062](https://access.redhat.com/security/cve/CVE-2026-29062)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2445135](https://bugzilla.redhat.com/show_bug.cgi?id=2445135)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29062.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29062.json)

## Related threats

- [Jackson Core denial of service via unbounded JSON property name allocation](https://junglewise.ai/threats/cve-2026-68498-streamreadconstraints-maxnamelength-default-50-000-characters-is)
- [FasterXML jackson-core denial of service in UTF8DataInputJsonParser](https://junglewise.ai/threats/cve-2026-89425-utf8datainputjsonparser-reportinvalidtoken-in-fasterxml-jackson)
- [FasterXML jackson-core regular expression denial of service in NumberInput](https://junglewise.ai/threats/cve-2026-89407-numberinput-lookslikevalidnumber-in-fasterxml-jackson-core-pre)
- [Duplicate Advisory: jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)](https://junglewise.ai/threats/duplicate-advisory-jackson-core-async-parser-maxnumberlength-bypass-via-a661244e)
- [FasterXML jackson-core number length constraint bypass in async parser](https://junglewise.ai/threats/fasterxml-jackson-core-number-length-constraint-bypass-in-async-parser-78aa3f75)