CVE-2026-86513
A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java of the component JSON Pointer parser. The manipulation results in allocation of resources. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.40%
- CWE
- CWE-770, CWE-400
- Published
- 2026-09-08
- Last modified
- 2026-09-08
Affected products
- java-json-tools jackson-coreutils
Weakness type
Related vulnerabilities
- CVE-2026-88012 — Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
- CVE-2026-45763 — Suricata lua: sandbox allocation limit not enforced for new allocations
- CVE-2026-88878 — Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
- CVE-2026-87011 — Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
- CVE-2023-54394 — PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket
- CVE-2026-53937 — MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
- CVE-2026-86075 — n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
- CVE-2026-57099 — ASP.NET Core Denial of Service Vulnerability