A flaw in the jackson‑coreutils JSON Pointer parser allows an attacker to trigger excessive resource allocation when calling the TreePointer.tokensFromInput method. The vulnerability can be triggered remotely and results in the library allocating large volumes of memory or processing time. Based on the description, it is inferred that this excessive allocation could cause application slowdown or crash, potentially disrupting service availability. The weakness is a classic uncontrolled resource consumption issue, reflected in the CWE-400 category, and involves out‑of‑bounds resource allocation, reflected in CWE-770.

The affected product is java‑json‑tools’ jackson‑coreutils, specifically version 2.0. This version is identified as vulnerable; no other versions are listed as affected.

The CVSS score of 6.9 indicates a moderate severity level. EPSS data is not available. The exploit is publicly released and can be executed remotely; based on the public release and remote execution, it is inferred that attackers may attempt to exploit it. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely detected in the wild. Based on the remote nature and available exploit, the risk is elevated particularly in environments where the library is exposed to untrusted input. Organizations running this version should treat the flaw as a significant risk to service availability.