CVE-2026-86511: java-json-tools jackson-coreutils JacksonUtils.java BigDecimal.toPlainString resource consumption
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consumption. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction according to the supplied vector. Exploitation involves manipulating input that reaches JacksonUtils.java's use of BigDecimal.toPlainString.
What is the practical impact?
The reported impact is resource consumption, with availability rated as low impact. The supplied vector does not indicate confidentiality or integrity impact.
Is public exploit information available?
Yes. The exploit has been made public and could be used.
Is a vendor fix or response available?
No response from the project is reported after it was informed through an issue report. The provided information does not identify a fixed version or a mitigation.