CVE-2026-86511 in jackson-coreutils
Summary
by MITRE • 09/08/2026
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consumption. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified within java-json-tools jackson-coreutils version 2.0 centers on a flaw in the BigDecimal.toPlainString method located in the source file src/main/java/com/github/fge/jackson/JacksonUtils.java. This component is integral to JSON processing utilities, specifically handling data type conversions and string representations of numerical values during serialization or deserialization processes. The core technical issue involves improper resource management when specific input manipulations are applied to BigDecimal instances. Rather than a traditional buffer overflow or code execution flaw, this vulnerability manifests as an algorithmic complexity weakness where the function enters a state of excessive computation or memory allocation under certain conditions. This behavior aligns with CWE-400, which describes uncontrolled resource consumption, often resulting in denial-of-service scenarios rather than unauthorized access to data or system control.
The operational impact of this vulnerability is primarily centered on service availability and performance degradation. An attacker who can trigger the affected code path by supplying crafted input may cause the application consuming jackson-coreutils to consume excessive CPU cycles or memory resources. In a web server context, where JSON parsing occurs frequently for incoming requests, this could lead to thread exhaustion or out-of-memory errors, effectively rendering the service unavailable to legitimate users. This constitutes a classic denial-of-service vector that does not require authentication if the affected endpoint is publicly accessible and processes untrusted input without sufficient validation limits on numerical precision or magnitude before conversion.
The attack surface for this vulnerability allows for remote initiation, meaning an adversary located over a network can exploit the flaw by sending specially crafted JSON payloads to any service utilizing this library version. The fact that the exploit has been made public significantly increases the risk landscape, as automated scanning tools and malicious actors can readily deploy proof-of-concept attacks against vulnerable systems. Although the project maintainers were notified early via an issue report, their lack of response indicates a potential gap in security maintenance for older or less actively maintained versions of this library. This delay leaves users exposed to known exploits without immediate patch availability from upstream sources.
Mitigation strategies must focus on both immediate workarounds and long-term remediation. Since the vulnerability resides within a specific utility function, developers should consider implementing input validation that restricts the scale and precision of BigDecimal inputs before they are passed to JacksonUtils methods. Alternatively, upgrading to a patched version of jackson-coreutils is the most effective solution once available from the maintainers. In environments where immediate patching is not feasible, deploying web application firewalls with rules designed to detect anomalous resource consumption patterns or limiting request payload sizes can provide an additional layer of defense against exploitation attempts. Organizations should also audit their dependency trees for other instances of this library version and prioritize updates across all affected services to ensure consistent security posture alignment with industry standards such as OWASP guidelines on input validation and secure coding practices.