CVE-2026-86513: java-json-tools jackson-coreutils JSON Pointer parser TreePointer.java TreePointer.tokensFromInput allocation of resources
A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java of the component JSON Pointer parser. The manipulation results in allocation of resources. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using java-json-tools jackson-coreutils 2.0 that process JSON Pointer input through TreePointer.tokensFromInput are exposed. The attack can be executed remotely.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network access, low attack complexity, no privileges required, and no user interaction.
What is the likely impact of a successful attack?
The reported effect is resource allocation, with availability impact rated low. The provided vector indicates no confidentiality or integrity impact.
Is public exploit information available?
Yes. The exploit has been released publicly and may be used in attacks.
Is a vendor response or fix identified?
No fix or vendor response is provided. The project was reportedly notified through an issue report but had not responded at the time of the report.