CVE-2026-29062: jackson-core Nesting Depth Constraint Bypass Vulnerability
Summary
CVE-2026-29062: The UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. Affects tools.jackson.core:jackson-core versions >= 3.0.0, < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-core is a widely used library in Java for processing JSON data. It provides functionalities for reading and writing JSON, making it a critical component in applications that rely on data interchange formats. The library is known for its performance and flexibility, but it has been found to have vulnerabilities that can lead to security issues, particularly when handling untrusted input.
Vulnerability Detail
The vulnerability in jackson-core arises from the UTF8DataInputJsonParser, which fails to enforce the maxNestingDepth constraint during JSON parsing. This oversight allows attackers to craft JSON documents with excessive nesting, potentially leading to a StackOverflowError. Such an error can result in a Denial of Service (DoS), making the application unresponsive. This issue is particularly concerning as it bypasses previously established security measures, allowing for resource exhaustion attacks.
How To Fix
Minimum fixed version
3.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users should avoid parsing JSON input from untrusted sources to mitigate the risk of this vulnerability until they can upgrade to the patched version.
Conclusion
The jackson-core vulnerability CVE-2026-29062 poses a significant risk to applications that rely on this library for JSON processing. By understanding the nature of the vulnerability and taking appropriate action to upgrade to the latest version, developers can protect their applications from potential Denial of Service attacks.
See every vulnerability recorded for tools.jackson.core:jackson-core →
FAQ
CVE-2026-29062 is a vulnerability in the jackson-core library that allows for a nesting depth constraint bypass, potentially leading to Denial of Service.
If your application uses jackson-core to parse JSON, it may be susceptible to resource exhaustion attacks, causing it to crash or become unresponsive.
You should upgrade to version 3.1.0 of jackson-core to mitigate the vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities using just your pom.xml. You can also check your application using the Vulert playground.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for tools.jackson.core:jackson-core.
