CVE-2026-86513
Received Received - Intake

JSON Resource Exhaustion in Jackson-Coreutils

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: VulDB

Description
A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java of the component JSON Pointer parser. The manipulation results in allocation of resources. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-08
Last Modified
2026-09-08
Generated
2026-09-08
AI Q&A
2026-09-08
EPSS Evaluated
N/A
NVD
CVE-2026-86513
EUVD
EUVD-2026-72614

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
java-json-tools jackson-coreutils 2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a resource exhaustion flaw in the jackson-coreutils library affecting the JSON Pointer parser. It involves two issues: quadratic CPU consumption from iterative substring operations and unbounded memory allocation from an ArrayList growing without limits. Exploiting this can cause denial-of-service attacks via crafted input strings.

Detection Guidance

Monitor for high CPU usage or memory exhaustion when processing JSON Pointer inputs. Check logs for OutOfMemoryError exceptions in applications using jackson-coreutils 2.0. Use network traffic analysis to detect unusually large JSON Patch or Pointer requests.

Impact Analysis

This vulnerability can impact you by causing denial-of-service conditions on systems using affected versions of jackson-coreutils. It may lead to high CPU usage and memory exhaustion, potentially crashing applications or services that process JSON Pointer or JSON Patch inputs.

Compliance Impact

This vulnerability enables denial-of-service attacks through resource exhaustion, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade to a patched version of jackson-coreutils if available. Implement input validation to limit JSON Pointer segment counts and string lengths. Add rate limiting to JSON Patch/Pointer endpoints to prevent abuse. Monitor for resource exhaustion attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86513. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart