# CVE-2026-86513: java-json-tools jackson-coreutils resource exhaustion in JSON Pointer parsing

Source: https://junglewise.ai/threats/cve-2026-86513-java-json-tools-jackson-coreutils-resource-exhaustion-in-json  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86513 · Severity: medium · CVSS 5.3 · Published 2026-09-08

jackson-coreutils is a Java library that implements JSON Pointer (RFC 6901) parsing for the Jackson framework. A flaw in the TreePointer.tokensFromInput function allows remote attackers to cause resource exhaustion through specially crafted input, leading to unbounded memory consumption and quadratic CPU usage that can degrade or disable services relying on this library.

Technologies: [Java-Json-Tools Jackson-Coreutils](https://junglewise.ai/threats/technologies/jackson-coreutils). Vendors: [Java-Json-Tools](https://junglewise.ai/threats/vendors/java-json-tools).

## Quick answers

**Is CVE-2026-86513 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86513 being exploited in the wild.

**How severe is CVE-2026-86513?** Medium severity, with a CVSS score of 5.3, published 8 September 2026.

**Which products and versions are affected?** Java-Json-Tools Jackson-Coreutils 2.0.

**Is there a fix for CVE-2026-86513?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86513 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86513?** Check whether you run Java-Json-Tools Jackson-Coreutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the JSON Pointer parser component (TreePointer class) in the tokensFromInput function, which improperly handles parsing of JSON Pointer tokens. The flaw results in quadratic CPU consumption and unbounded memory exhaustion when processing maliciously crafted JSON Pointer input. The attack is remotely exploitable over the network without authentication or user interaction required. An attacker can trigger a denial-of-service condition by sending specially crafted payloads that cause the parser to allocate excessive resources. The developer has been notified but has not yet released a patch as of the publication date.

## Affected products

- java-json-tools jackson-coreutils 2.0

## Timeline

- 2026-07-29: disclosed: Security issue reported on GitHub
- 2026-09-08: advisory: CVE-2026-86513 published

## References

- [https://github.com/java-json-tools/jackson-coreutils/](https://github.com/java-json-tools/jackson-coreutils/)
- [https://github.com/java-json-tools/jackson-coreutils/issues/66](https://github.com/java-json-tools/jackson-coreutils/issues/66)

## Related threats

- [java-json-tools jackson-coreutils resource exhaustion in BigDecimal serialization](https://junglewise.ai/threats/cve-2026-86511-java-json-tools-jackson-coreutils-resource-exhaustion-in)
- [java-json-tools jackson-coreutils server-side request forgery in JsonLoader](https://junglewise.ai/threats/cve-2026-86321-java-json-tools-jackson-coreutils-server-side-request-forgery-in)