CVE-2026-86321
Received Received - Intake

Server-Side Request Forgery in jackson-coreutils

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86321
EUVD
EUVD-2026-72481

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
java-json-tools jackson-coreutils 2.0
java-json-tools jackson-coreutils to 2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86321 is a Server-Side Request Forgery (SSRF) vulnerability in the jackson-coreutils library affecting versions up to 2.0. It occurs in the JsonLoader.fromURL function due to lack of URL validation, allowing attackers to send requests to internal services or local files by passing malicious URLs. Additionally, a BigDecimal amplification attack can crash the JVM by parsing a tiny JSON payload like {"x": 1e2000000000} which expands to a 2GB string during serialization.

Detection Guidance

To detect this vulnerability, inspect applications using jackson-coreutils 2.0 for usage of JsonLoader.fromURL() with user-controlled URLs. Check for unexpected network requests to internal services or large memory usage spikes when processing JSON. Monitor logs for OutOfMemoryError exceptions during JSON serialization.

Impact Analysis

This vulnerability can impact you by allowing remote attackers to perform SSRF attacks, potentially accessing internal systems or files. It can also cause denial-of-service (DoS) by crashing the application or JVM through memory exhaustion when processing specially crafted JSON payloads.

Mitigation Strategies

Immediately upgrade to Jackson 2.15+ for built-in stream constraints. Disable WRITE_BIGDECIMAL_AS_PLAIN in JacksonUtils.newMapper(). Add URL validation in JsonLoader.fromURL() to block internal/local file access. Validate BigDecimal scale to prevent amplification attacks. Remove jackson-coreutils 2.0 if unused.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86321. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart