CVE-2026-86321: java-json-tools jackson-coreutils URL Validation JsonLoader.java JsonLoader.fromURL server-side request forgery
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The reported CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. The issue is reported as remotely exploitable.
Which deployments should be investigated first?
Investigate applications using java-json-tools jackson-coreutils 2.0, particularly where JsonLoader.fromURL in JsonLoader.java is used for URL loading. The provided data does not identify any affected versions other than 2.0.
Is a fix or vendor response available?
The project was reportedly notified through an issue report but had not responded at the time of publication. No fixed version or documented workaround is provided in the available data.
How can teams determine whether they may be affected?
Identify whether jackson-coreutils version 2.0 is present and whether the application invokes JsonLoader.fromURL. The available data does not provide detection indicators, logs, or request patterns for confirming exploitation.