CVE-2026-86511

java-json-tools jackson-coreutils JacksonUtils.java BigDecimal.toPlainString resource consumption

View on CVE.org
Published Sep 8, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consumption. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

The issue resides in the BigDecimal.toPlainString method within jackson-coreutils 2.0, where an attacker can craft input that forces the method to consume excessive CPU or memory. This does not enable code execution or data disclosure, but it can degrade availability of the Java process. The flaw is classified as resource exhaustion (CWE-400) and improper resource management (CWE-404).

Affected Systems

Any Java application that includes the java‑json‑tools jackson‑coreutils library version 2.0 and calls BigDecimal.toPlainString, especially when the input originates from an untrusted source, is susceptible.

Risk and Exploitability

The CVSS score of 6.9 denotes moderate severity. EPSS data is unavailable, yet the exploit is publicly disclosed and can be launched remotely, raising the likelihood of abuse. The vulnerability is not listed in CISA KEV, but defenders should treat it as a moderate risk and watch for abnormal CPU or memory usage that could signal an attack.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a fixed release of jackson‑coreutils when it becomes available, or replace the library with an alternative that does not expose the vulnerable method.
  • Introduce input validation or impose size limits before data is processed by BigDecimal.toPlainString to constrain resource consumption.
  • Configure monitoring and alerting on high CPU or memory usage to detect and react to potential denial‑of‑service attempts.

Generated by OpenCVE AI on September 8, 2026 at 03:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consumption. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Title java-json-tools jackson-coreutils JacksonUtils.java BigDecimal.toPlainString resource consumption
First Time appeared Java-json-tools
Java-json-tools jackson-coreutils
Weaknesses CWE-400
CWE-404
CPEs cpe:2.3:a:java-json-tools:jackson-coreutils:*:*:*:*:*:*:*:*
Vendors & Products Java-json-tools
Java-json-tools jackson-coreutils
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-404

    Improper Resource Shutdown or Release

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 8, 2026, 12:34 PM
Reserved
Sep 7, 2026, 6:54 PM

View source JSON

Updated
Sep 8, 2026, 12:34 PM

JSON

Status
Deferred
Published
Sep 8, 2026, 3:17 AM
Modified
Sep 28, 2026, 11:10 PM

View source JSON

No data.

Updated
Sep 8, 2026, 7:30 AM

JSON