CVE-2026-86511: jackson-coreutils DOS Vulnerability

CVE-2026-86511 Overview

CVE-2026-86511 affects java-json-tools jackson-coreutils version 2.0. The vulnerability resides in the BigDecimal.toPlainString call within src/main/java/com/github/fge/jackson/JacksonUtils.java. An attacker can trigger uncontrolled resource consumption [CWE-400] by supplying crafted input that forces the library to expand very large or high-precision decimal values into their plain string representation.

The flaw is exploitable remotely without authentication or user interaction. Public exploit details have been disclosed, and the maintainers were notified through an issue report but had not responded at the time of publication.

Critical Impact
Remote attackers can degrade availability of Java services that parse untrusted JSON containing large BigDecimal values, consuming CPU and memory during string conversion.

Affected Products

java-json-tools jackson-coreutils 2.0
Applications embedding the affected JacksonUtils.java component
Downstream Java projects depending on jackson-coreutils for JSON processing

Discovery Timeline

2026-09-08 - CVE-2026-86511 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86511

Vulnerability Analysis

The vulnerability is a resource exhaustion issue classified under [CWE-400]. jackson-coreutils uses BigDecimal.toPlainString() when normalizing JSON numeric nodes inside JacksonUtils.java. BigDecimal supports arbitrary precision and exponent values, and its toPlainString() method materializes the full non-scientific decimal representation.

When an attacker supplies a JSON number with a very large negative scale, such as 1E+1000000, the JVM must allocate and construct a decimal string containing roughly one million characters. Repeated or concurrent requests amplify CPU and heap pressure, producing a denial-of-service condition on services that process untrusted JSON.

Root Cause

The root cause is missing input validation on the magnitude of BigDecimal values before invoking toPlainString(). The library does not bound the scale, precision, or resulting string length. Any code path that funnels attacker-controlled JSON through JacksonUtils inherits the issue.

Attack Vector

Exploitation is network based and requires no privileges or user interaction. An attacker submits a JSON payload containing an extreme numeric literal to any endpoint that deserializes JSON with jackson-coreutils. The affected code then attempts the plain-string conversion, blocking a worker thread and consuming memory. See the GitHub Issue #65 Discussion and the VulDB CVE-2026-86511 Detail for reference material.

No verified proof-of-concept code has been reproduced here. Refer to the linked upstream issue for technical detail.

Detection Methods for CVE-2026-86511

Indicators of Compromise

Sustained CPU saturation in Java worker threads executing com.github.fge.jackson.JacksonUtils
Heap growth or OutOfMemoryError events correlated with inbound JSON requests
HTTP request bodies containing numeric literals with extreme exponents such as 1E+1000000
Thread dumps showing threads blocked inside java.math.BigDecimal.toPlainString

Detection Strategies

Perform software composition analysis to identify projects declaring com.github.fge:jackson-coreutils:2.0 as a direct or transitive dependency
Enable JVM flight recorder or async profiler samples to flag long-running BigDecimal.toPlainString invocations
Add web application firewall rules that inspect JSON bodies for numeric literals exceeding a reasonable exponent or digit length

Monitoring Recommendations

Track request latency percentiles for endpoints that accept JSON and alert on sudden tail-latency growth
Monitor JVM garbage-collection frequency and old-generation occupancy for services depending on jackson-coreutils
Log and rate-limit clients that submit oversized JSON payloads or requests that time out during parsing

How to Mitigate CVE-2026-86511

Immediate Actions Required

Inventory all Java services that include jackson-coreutils 2.0 as a direct or transitive dependency
Enforce request size limits and JSON parser hardening on any endpoint accepting untrusted JSON
Restrict inbound access to internal services that cannot be immediately hardened
Configure request timeouts so a single JSON deserialization cannot occupy a worker thread indefinitely

Patch Information

No vendor patch is available at the time of publication. The maintainers were notified through the upstream tracker but have not responded. Monitor the GitHub Jackson CoreUtils Repository and GitHub Issue #65 Discussion for updates.

Workarounds

Validate JSON numeric fields upstream and reject values whose exponent or digit count exceeds application requirements
Wrap calls into JacksonUtils with a bounded executor that enforces CPU-time or wall-clock limits
Consider replacing or shading the affected code path with a custom serializer that avoids BigDecimal.toPlainString on untrusted input
Deploy a reverse proxy or WAF rule to strip or reject numeric literals with excessive exponents

bash

# Example ModSecurity rule to block JSON numbers with extreme exponents
SecRule REQUEST_HEADERS:Content-Type "@contains application/json" \
    "id:1008651,phase:2,deny,status:400,\
    msg:'Potential CVE-2026-86511 BigDecimal DoS payload',\
    chain"
    SecRule REQUEST_BODY "@rx [0-9]+(\.[0-9]+)?[eE][+-]?[0-9]{5,}" \
        "t:none"