CVE-2026-86511
Received Received - Intake

Resource Consumption in jackson-coreutils via BigDecimal.toPlainString

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: VulDB

Description
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consumption. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-08
Last Modified
2026-09-08
Generated
2026-09-08
AI Q&A
2026-09-08
EPSS Evaluated
N/A
NVD
CVE-2026-86511
EUVD
EUVD-2026-72617

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
java-json-tools jackson-coreutils 2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86511 is a Denial of Service (DoS) vulnerability in the jackson-coreutils library version 2.0. It occurs when the library's default ObjectMapper configuration enables features that cause BigDecimal.toPlainString() to allocate excessive memory during JSON serialization. Specifically, parsing large-exponent numbers like 1e100000 triggers massive string allocations, leading to JVM OutOfMemoryError.

Detection Guidance

To detect this vulnerability, monitor for OutOfMemoryError exceptions in applications using jackson-coreutils 2.0. Check logs for large JSON payloads with high-exponent numbers (e.g., 1e100000). Use tools like Wireshark to inspect network traffic for unusually large JSON responses or requests.

Impact Analysis

This vulnerability allows remote attackers to cause a DoS by sending a single malicious JSON request. The attack consumes excessive server memory, potentially crashing the application. Any system using jackson-coreutils 2.0 to parse or serialize JSON is affected, including endpoints handling HTTP requests, file uploads, or message queues. The impact is amplified by factors up to 250 million times the input size.

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) through memory exhaustion, which could disrupt services handling untrusted JSON input. While not directly violating GDPR or HIPAA, such disruptions may impact availability of personal or health data systems, potentially leading to compliance issues if they prevent timely access to required data.

Mitigation Strategies
  • Disable WRITE_BIGDECIMAL_AS_PLAIN in the ObjectMapper configuration.
  • Add scale validation before serialization to block excessively large BigDecimal values.
  • Upgrade to Jackson 2.15 or later to use StreamWriteConstraints.
  • Audit dependencies for transitive usage of jackson-coreutils.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86511. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart