Resource Consumption Vulnerability in Jackson-CoreUtils by Java-JSON-Tools
CVE-2026-86511

6.9MEDIUM

Key Information:

Vendor: Java-json-tools
Status: Jackson-coreutils
Vendor: CVE Published:; 8 September 2026

🔔 Create Java-json-tools Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-86511?

A resource consumption vulnerability has been identified in the Jackson-CoreUtils library version 2.0, found in the BigDecimal.toPlainString function within the JacksonUtils.java file. This vulnerability allows an attacker to manipulate resources, leading to potential denial of service. The exploit can be executed remotely, making it a significant concern for users of the affected version. Despite early notification of the issue via an issue report, there has been no response from the project maintainers regarding a fix. For more information, please refer to the documentation and resources available.

Affected Version(s)

jackson-coreutils 2.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-86511 - Proof of Concept