CVE-2026-86513: jackson-coreutils DOS Vulnerability

CVE-2026-86513 Overview

CVE-2026-86513 is a resource allocation vulnerability in java-json-tools jackson-coreutils version 2.0. The flaw resides in the TreePointer.tokensFromInput function within src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java, part of the JSON Pointer parser component. Attackers can trigger uncontrolled resource allocation [CWE-400] by supplying crafted input to the parser. The attack is remotely exploitable and requires no authentication or user interaction. Public exploit code has been released, increasing the likelihood of opportunistic exploitation. The maintainers received an issue report but have not yet responded at the time of publication.

Critical Impact
Remote attackers can exhaust memory or CPU resources in Java applications that parse untrusted JSON Pointer input using jackson-coreutils 2.0, leading to denial of service.

Affected Products

java-json-tools jackson-coreutils 2.0
Java applications embedding the vulnerable TreePointer parser
Downstream libraries and services depending on jackson-coreutils for JSON Pointer processing

Discovery Timeline

2026-09-08 - CVE-2026-86513 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86513

Vulnerability Analysis

The vulnerability affects the JSON Pointer parser implemented in TreePointer.tokensFromInput. This function converts a JSON Pointer string into a list of reference tokens used to traverse a JSON tree. When the parser receives specially crafted input, it allocates resources without adequate bounds enforcement. The behavior maps to the Common Weakness Enumeration category [CWE-400] Uncontrolled Resource Consumption. Applications that expose JSON Pointer parsing to network-reachable endpoints are directly at risk. Because parsing occurs before business logic, an attacker can degrade service availability with minimal request volume. Public exploit code lowers the technical bar for weaponization.

Root Cause

The root cause is missing input validation and bounded allocation inside tokensFromInput. The function processes pointer segments and stores tokens without capping the total allocation triggered by a single input. A single crafted string can therefore drive memory or CPU consumption disproportionate to its size. Refer to the GitHub Issue #66 Discussion for maintainer-facing context.

Attack Vector

Exploitation occurs over the network without authentication. Any endpoint that forwards attacker-controlled strings into JsonPointer construction, such as REST APIs handling JSON Patch, JSON Merge Patch, or JSON Pointer query parameters, becomes a viable target. Repeated crafted requests can amplify the effect and destabilize dependent services. No memory-corruption primitive is present; impact is limited to availability. Additional details are catalogued in the VulDB CVE-2026-86513 Report.

Detection Methods for CVE-2026-86513

Indicators of Compromise

Sudden spikes in Java Virtual Machine (JVM) heap usage, garbage collection pauses, or OutOfMemoryError events tied to JSON Pointer parsing frames
Elevated CPU consumption in threads executing com.github.fge.jackson.jsonpointer.TreePointer.tokensFromInput
Repeated inbound HTTP requests containing unusually long or deeply structured JSON Pointer strings from a small set of source addresses

Detection Strategies

Instrument application performance monitoring to alert on stack traces referencing TreePointer during memory pressure events
Deploy web application firewall rules that flag JSON Pointer inputs exceeding a reasonable length or token count threshold
Correlate service-level indicators such as latency and error rate with request payload size distributions to identify amplification patterns

Monitoring Recommendations

Enable verbose JVM garbage collection logging and forward it to a central analytics platform for anomaly detection
Track dependency inventories to identify services embedding jackson-coreutils 2.0, directly or transitively
Monitor egress and internal API traffic for repeated malformed JSON Patch or Pointer payloads

How to Mitigate CVE-2026-86513

Immediate Actions Required

Inventory all Java applications and container images that bundle jackson-coreutils 2.0, including transitive dependencies
Restrict network exposure of endpoints that parse untrusted JSON Pointer, JSON Patch, or JSON Merge Patch input
Enforce request-level input size limits and rate limiting at the reverse proxy or API gateway layer
Configure JVM memory ceilings and per-request timeouts to contain resource exhaustion attempts

Patch Information

At the time of publication, no vendor patch has been released. The maintainers were notified through an issue report but have not responded. Track the GitHub Repository for Jackson Coreutils and the GitHub Issue #66 Discussion for remediation updates. Once a fixed release is published, upgrade all affected services and rebuild dependent artifacts.

Workarounds

Validate and reject JSON Pointer strings above a conservative maximum length before passing them to the parser
Wrap TreePointer invocations in a bounded executor with strict timeouts to cap CPU exposure per request
Where feasible, substitute an alternative JSON Pointer implementation until a patched jackson-coreutils release is available

bash

# Configuration example
# Example reverse proxy guard: reject requests with oversized JSON Pointer fields
# Adjust the length threshold to match legitimate application usage
location /api/ {
    client_max_body_size 64k;
    if ($request_uri ~* "[?&]pointer=[^&]{512,}") {
        return 413;
    }
    proxy_pass http://backend;
}