Executive brief
jackson-coreutils is a library used to process JSON data in Java applications. A vulnerability in its default configuration causes exponential memory consumption when serializing certain numeric values, allowing an attacker to crash the application with a small JSON payload. This denial-of-service condition requires no authentication and affects many downstream projects that depend on this library.
Technical details
The vulnerability is a resource exhaustion (CWE-400) affecting the BigDecimal.toPlainString() method in JacksonUtils.java. The default ObjectMapper configuration enables both USE_BIG_DECIMAL_FOR_FLOATS and WRITE_BIGDECIMAL_AS_PLAIN features. When untrusted JSON containing large-exponent numbers (e.g., 1e100000) is parsed and then serialized, toPlainString() allocates memory proportional to the exponent, causing amplification factors up to 250,000,000x. An attacker can send a small JSON payload (e.g., 20 bytes) to trigger OutOfMemoryError. The attack vector is network-accessible (any endpoint accepting JSON) and requires no authentication or user interaction. The vulnerability affects jackson-coreutils 2.0 and is inherited by downstream libraries including json-schema-validator (26K+ dependents).
Affected products
- java-json-tools jackson-coreutils 2.0
Timeline
- 2026-07-28: disclosed: Security vulnerability reported via GitHub issue #65
- 2026-09-08: advisory: CVE-2026-86511 published