Description
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
FasterXML jackson-core
>= 3.0.0, < 3.1.0affected
References
- https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56r ↗
- https://github.com/FasterXML/jackson-core/pull/1554 ↗
- https://github.com/FasterXML/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaab06cd5a902 ↗
- https://access.redhat.com/security/cve/CVE-2026-29062 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2445135 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29062.json ↗