The vulnerability exists in the JsonLoader.fromURL method of the jackson-coreutils library. A crafted URL can cause the method to perform an arbitrary outbound request, allowing a remote attacker to force the server to access external or internal resources. This leads to server‑side request forgery, potentially exposing sensitive data or enabling further attacks.

The affected product is java‑json‑tools’ jackson‑coreutils, version 2.0. The issue is tied to the URL Validation component within that library. No other versions are documented as vulnerable, and the project has not yet released a fix, so users with 2.0 or any unpatched higher versions may be at risk.

The CVSS score of 6.9 indicates moderate severity, and the exploit is publicly available, though no EPSS data is reported. The library is not listed in CISA’s KEV catalog. The likely exploitation path involves sending a malicious URL to an application that uses JsonLoader.fromURL, causing the server to resolve and fetch the URL and potentially reach internal services that should not be exposed. The lack of a patch increases the importance of monitoring for this vector.