8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29062

CVE-2026-29062: jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29062

CVE-2026-29062:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tools.jackson.core:jackson-core	maven	>= 3.0.0, < 3.1.0	3.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the bypass of the maxNestingDepth constraint in jackson-core, specifically within the UTF8DataInputJsonParser and ReaderBasedJsonParser classes. The advisory and the provided commit 8b25fd67f20583e75fb09564ce1eaab06cd5a902 clearly indicate the source of the vulnerability. The patch modifies two key files:

src/main/java/tools/jackson/core/json/UTF8DataInputJsonParser.java: The change is within the _nextTokenNotInObject method. Previously, it directly created a new child context using _streamReadContext.createChildArrayContext or _streamReadContext.createChildObjectContext. This direct creation bypassed the nesting depth check. The fix replaces these calls with createChildArrayContext and createChildObjectContext methods, which were introduced to centralize and enforce the maxNestingDepth constraint.
src/main/java/tools/jackson/core/json/ReaderBasedJsonParser.java: A similar flaw existed in the nextLongValue method. It also created child contexts without validation. The patch applies the same fix, redirecting the context creation to the new, safer methods.

By analyzing these changes, it's evident that any code path leading to the execution of _nextTokenNotInObject in UTF8DataInputJsonParser or nextLongValue in ReaderBasedJsonParser with a malicious, deeply nested JSON input would trigger the vulnerability. These functions are therefore the primary indicators that would appear in a runtime profile during exploitation.

Vulnerable functions

tools.jackson.core.json.UTF8DataInputJsonParser._nextTokenNotInObject

src/main/java/tools/jackson/core/json/UTF8DataInputJsonParser.java

The function `_nextTokenNotInObject` in `UTF8DataInputJsonParser` was vulnerable to a resource exhaustion attack. When parsing a JSON stream, it would create new child contexts for arrays ('[') and objects ('{') without checking the current nesting depth. The fix replaces the direct context creation with calls to `createChildArrayContext` and `createChildObjectContext`, which enforce the `maxNestingDepth` constraint defined in `StreamReadConstraints`. This prevents a `StackOverflowError` from deeply nested JSON input.

tools.jackson.core.json.ReaderBasedJsonParser.nextLongValue

src/main/java/tools/jackson/core/json/ReaderBasedJsonParser.java

Similar to the vulnerability in `UTF8DataInputJsonParser`, the `nextLongValue` function in `ReaderBasedJsonParser` also failed to check the nesting depth before creating child contexts for arrays and objects. This could be exploited to cause a `StackOverflowError` with a specially crafted JSON input. The patch applies the same fix by calling the new methods that perform the depth validation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.