CVE-2026-86321 in jackson-coreutils
Summary
by MITRE • 09/07/2026
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified within java-json-tools jackson-coreutils version 2.0 represents a critical security flaw located in the URL validation logic, specifically affecting the JsonLoader.fromURL function found in src/main/java/com/github/fge/jackson/JsonLoader.java. This component is responsible for loading JSON resources from various sources, including Uniform Resource Locators. The core technical issue stems from insufficient input validation and sanitization of URLs provided to this method. When an attacker supplies a maliciously crafted URL, the application fails to adequately restrict or verify the destination before initiating network requests. This lack of rigorous checks allows the underlying system to resolve and connect to arbitrary hosts determined by the user's input rather than adhering to expected internal resources or safe external domains.
This flaw directly facilitates Server-Side Request Forgery attacks, a category of vulnerability where an attacker tricks a server into making HTTP requests to an unintended location. In this context, because JsonLoader.fromURL is often used in backend processing pipelines that handle untrusted JSON data, the ability to control the target URL enables significant operational impact. An adversary can leverage this capability to perform internal network reconnaissance by probing ports and services on private IP addresses that are not exposed to the public internet. Furthermore, it allows for unauthorized access to sensitive metadata endpoints of cloud infrastructure providers, such as AWS EC2 instance metadata service or Azure managed identity endpoints, which often contain authentication tokens and configuration secrets. The attack can also be used to exfiltrate data from internal web applications by forcing the server to fetch content and potentially relay it back through error messages or timing differences if combined with other techniques like blind SSRF.
The severity of this vulnerability is compounded by its remote exploitability, meaning no prior authentication or local access is required for an attacker to initiate the attack vector. The fact that a public proof-of-concept exists significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated exploitation in the wild. Although the project maintainers were notified early via issue reports, the lack of immediate response leaves users exposed during this window of opportunity. This delay highlights the importance of proactive security monitoring and timely patching strategies within software supply chains that depend on third-party libraries like jackson-coreutils.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), which describes flaws where web applications retrieve data from remote servers without validating the user-supplied URL. Additionally, it maps to MITRE ATT&CK technique T1571, Non-Standard Port, and potentially T1046 Network Service Discovery if used for scanning internal networks. The attack pattern also relates to CWE-20 Improper Input Validation, as the root cause is the failure to properly sanitize or validate external input before processing it in a security-critical function.
To mitigate this risk, organizations should immediately upgrade jackson-coreutils to a patched version that implements strict URL validation policies if available from upstream maintainers. In cases where an immediate patch is not feasible, defensive measures must be implemented at the infrastructure level. This includes configuring network firewalls and proxy servers to block outbound connections from application servers to internal IP ranges or known malicious domains. Implementing egress filtering rules that restrict HTTP traffic to only whitelisted external endpoints can effectively neutralize SSRF attempts. Additionally, developers should avoid using JsonLoader.fromURL with untrusted input in production environments until a secure alternative is identified. Regular security audits and static application security testing (SAST) scans focused on URL handling functions are recommended to detect similar patterns in custom codebases that may rely on this library or similar utilities.