Executive brief
jackson-coreutils is a Java library that implements JSON Pointer (RFC 6901) parsing for the Jackson framework. A flaw in the TreePointer.tokensFromInput function allows remote attackers to cause resource exhaustion through specially crafted input, leading to unbounded memory consumption and quadratic CPU usage that can degrade or disable services relying on this library.
Technical details
The vulnerability exists in the JSON Pointer parser component (TreePointer class) in the tokensFromInput function, which improperly handles parsing of JSON Pointer tokens. The flaw results in quadratic CPU consumption and unbounded memory exhaustion when processing maliciously crafted JSON Pointer input. The attack is remotely exploitable over the network without authentication or user interaction required. An attacker can trigger a denial-of-service condition by sending specially crafted payloads that cause the parser to allocate excessive resources. The developer has been notified but has not yet released a patch as of the publication date.
Affected products
- java-json-tools jackson-coreutils 2.0
Timeline
- 2026-07-29: disclosed: Security issue reported on GitHub
- 2026-09-08: advisory: CVE-2026-86513 published