CVE-2026-86511
java-json-tools jackson-coreutils JacksonUtils.java BigDecimal.toPlainString resource consumption
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consumption. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-400 CWE-404 |
| Vendor | java-json-tools |
| Product | jackson-coreutils |
| Published | Sep 8, 2026 |
| Last Updated | Sep 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for java-json-tools jackson-coreutils
Be the first to know when new medium vulnerabilities affecting java-json-tools jackson-coreutils are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
java-json-tools / jackson-coreutils
2.0
References
vuldb.com: https://vuldb.com/vuln/399664 vuldb.com: https://vuldb.com/vuln/399664/cti vuldb.com: https://vuldb.com/cve/CVE-2026-86511 vuldb.com: https://vuldb.com/submit/908322 github.com: https://github.com/java-json-tools/jackson-coreutils/issues/65 github.com: https://github.com/java-json-tools/jackson-coreutils/
Credits
🔍 York Shen - Yong Shen - PayPal Cyber Security Team (VulDB User) VulDB CNA Team