Is CVE-2026-86511 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86511 being exploited in the wild.

How severe is CVE-2026-86511?

Medium severity, with a CVSS score of 5.3, published 8 September 2026.

Which products and versions are affected?

Java-Json-Tools Jackson-Coreutils 2.0.

Is there a fix for CVE-2026-86511?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86511 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86511?

Check whether you run Java-Json-Tools Jackson-Coreutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86511: java-json-tools jackson-coreutils resource exhaustion in BigDecimal serialization

CVE-2026-86511 · Severity: medium · CVSS 5.3 · Published 2026-09-08

jackson-coreutils is a library used to process JSON data in Java applications. A vulnerability in its default configuration causes exponential memory consumption when serializing certain numeric values, allowing an attacker to crash the application with a small JSON payload. This denial-of-service condition requires no authentication and affects many downstream projects that depend on this library.

Technologies: Java-Json-Tools Jackson-Coreutils. Vendors: Java-Json-Tools.

Quick answers

Is CVE-2026-86511 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86511 being exploited in the wild.
How severe is CVE-2026-86511?: Medium severity, with a CVSS score of 5.3, published 8 September 2026.
Which products and versions are affected?: Java-Json-Tools Jackson-Coreutils 2.0.
Is there a fix for CVE-2026-86511?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86511 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86511?: Check whether you run Java-Json-Tools Jackson-Coreutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a resource exhaustion (CWE-400) affecting the BigDecimal.toPlainString() method in JacksonUtils.java. The default ObjectMapper configuration enables both USE_BIG_DECIMAL_FOR_FLOATS and WRITE_BIGDECIMAL_AS_PLAIN features. When untrusted JSON containing large-exponent numbers (e.g., 1e100000) is parsed and then serialized, toPlainString() allocates memory proportional to the exponent, causing amplification factors up to 250,000,000x. An attacker can send a small JSON payload (e.g., 20 bytes) to trigger OutOfMemoryError. The attack vector is network-accessible (any endpoint accepting JSON) and requires no authentication or user interaction. The vulnerability affects jackson-coreutils 2.0 and is inherited by downstream libraries including json-schema-validator (26K+ dependents).

Affected products

java-json-tools jackson-coreutils 2.0

Timeline

2026-07-28: disclosed: Security vulnerability reported via GitHub issue #65
2026-09-08: advisory: CVE-2026-86511 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.