p PatchFirst

CVE-2026-29062

CVE-2026-29062 · jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion

This page contains facts from public vulnerability sources. Check the original advisory before updating.

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.

CVSS 8.7 · High · EPSS 0.8%

Published
Updated

Stack: system

Affected products and versions

  • jackson-core

    Versions
    • >= 3.0.0, < 3.1.0: Affected

    No fix published

  • jackson-core Ubuntu:16.04:LTS

    Versions
    • 2.4.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jackson-core Ubuntu:18.04:LTS

    Versions
    • 2.8.6-1
    • 2.9.1-1
    • 2.9.4-1
    • 2.9.8-3~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jackson-core Ubuntu:20.04:LTS

    Versions
    • 2.9.8-3
    • 2.10.0-1
    • 2.10.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jackson-core Ubuntu:22.04:LTS

    Versions
    • 2.12.1-1
    • 2.13.0-1
    • 2.13.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jackson-core Ubuntu:24.04:LTS

    Versions
    • 2.14.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jackson-core Ubuntu:25.10

    Versions
    • 2.14.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jackson-core Ubuntu:26.10

    Versions
    • 2.14.1-1build1
    • 2.14.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jackson-core Ubuntu:26.04:LTS

    Versions
    • 2.14.1-1
    • 2.14.1-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →