Executive brief
jackson-coreutils is a JSON utility library for Jackson that provides JSON pointer support and validation. The JsonLoader.fromURL() method fails to validate URLs before fetching them, allowing an attacker to trigger requests to internal services and combine this with a BigDecimal parsing flaw to cause application crashes through memory exhaustion.
Technical details
The vulnerability is a server-side request forgery (SSRF) combined with denial-of-service amplification via unsafe BigDecimal serialization. The JsonLoader.fromURL() method in src/main/java/com/github/fge/jackson/JsonLoader.java performs no scheme or hostname validation, accepting any URL including file:// URIs and internal IPs like 169.254.169.254. When combined with the default JacksonUtils configuration that enables WRITE_BIGDECIMAL_AS_PLAIN serialization, an attacker can serve a tiny JSON payload (e.g., {"x": 1e2000000000}) that expands to gigabytes in memory when deserialized and later serialized, causing OutOfMemoryError. The attack requires only network reachability and user control over URLs passed to fromURL(), with no authentication required. The vulnerability has been publicly disclosed with working proof-of-concept code and affects jackson-coreutils 2.0.
Affected products
- java-json-tools jackson-coreutils 2.0
Timeline
- 2026-07-28: disclosed
- 2026-09-07: advisory