Description
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consumption. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-08
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (resource exhaustion)
Action: Apply Update
AI Analysis

Impact

The issue resides in the BigDecimal.toPlainString method within jackson-coreutils 2.0, where an attacker can craft input that forces the method to consume excessive CPU or memory. This does not enable code execution or data disclosure, but it can degrade availability of the Java process. The flaw is classified as resource exhaustion (CWE-400) and improper resource management (CWE-404).

Affected Systems

Any Java application that includes the java‑json‑tools jackson‑coreutils library version 2.0 and calls BigDecimal.toPlainString, especially when the input originates from an untrusted source, is susceptible.

Risk and Exploitability

The CVSS score of 6.9 denotes moderate severity. EPSS data is unavailable, yet the exploit is publicly disclosed and can be launched remotely, raising the likelihood of abuse. The vulnerability is not listed in CISA KEV, but defenders should treat it as a moderate risk and watch for abnormal CPU or memory usage that could signal an attack.

Generated by OpenCVE AI on September 8, 2026 at 03:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a fixed release of jackson‑coreutils when it becomes available, or replace the library with an alternative that does not expose the vulnerable method.
  • Introduce input validation or impose size limits before data is processed by BigDecimal.toPlainString to constrain resource consumption.
  • Configure monitoring and alerting on high CPU or memory usage to detect and react to potential denial‑of‑service attempts.

Generated by OpenCVE AI on September 8, 2026 at 03:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consumption. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Title java-json-tools jackson-coreutils JacksonUtils.java BigDecimal.toPlainString resource consumption
First Time appeared Java-json-tools
Java-json-tools jackson-coreutils
Weaknesses CWE-400
CWE-404
CPEs cpe:2.3:a:java-json-tools:jackson-coreutils:*:*:*:*:*:*:*:*
Vendors & Products Java-json-tools
Java-json-tools jackson-coreutils
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Java-json-tools Jackson-coreutils
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-08T12:34:05.369Z

Reserved: 2026-09-07T18:54:11.540Z

Link: CVE-2026-86511

cve-icon Vulnrichment

Updated: 2026-09-08T12:34:00.479Z

cve-icon NVD

Status : Deferred

Published: 2026-09-08T03:17:19.257

Modified: 2026-09-08T13:17:30.117

Link: CVE-2026-86511

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T07:30:04Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-404

    Improper Resource Shutdown or Release