Which versions of jackson-core are affected by CVE-2026-29062?

FasterXML jackson-core versions 3.0.0-3.0.x contain a remotely exploitable denial-of-service vulnerability affecting JSON-parsing services across the organization.. A patch is available.

How to fix or mitigate CVE-2026-29062?

24 hours: Inventory all applications using jackson-core 3.0.0-3.0.x and prioritize critical systems. 7 days: Deploy jackson-core 3.1.0 to development and staging environments and validate JSON parsing functionality. 30 days: Complete production deployment of jackson-core 3.1.0 across all systems.

jackson-core CVE-2026-29062

Q: What is the CVSS score of CVE-2026-29062?

CVE-2026-29062 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-03-06 security-advisories@github.com

GHSA-6v53-7c9g-w56r

Denial Of Service Jackson Core

8.7

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, unauthenticated, low-complexity parsing of attacker JSON yields only availability loss via StackOverflowError, so A:H with C:N/I:N and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 05:02 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:00 vuln.today

v4 (cvss_changed)

Source Code Evidence Fetched

Jun 30, 2026 - 04:59 vuln.today

Analysis Updated

Jun 30, 2026 - 04:59 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:59 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 03:24 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 10, 2026 - 19:05 nvd

Patch available

CVE Published

Mar 06, 2026 - 08:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

379 maven packages depend on tools.jackson.core:jackson-core (74 direct, 305 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.

AnalysisAI

Uncontrolled-recursion denial of service in FasterXML jackson-core 3.0.0 through 3.0.x lets a remote attacker crash JSON-processing services by submitting a deeply nested JSON document. The UTF8DataInputJsonParser (DataInput sources) and ReaderBasedJsonParser fail to enforce the StreamReadConstraints maxNestingDepth limit (default 500), so excessive nesting drives a StackOverflowError. No public exploit identified at time of analysis and EPSS is low (0.06%), but the bug is trivially triggerable against any service that parses untrusted JSON with these parsers; fixed in 3.1.0.

Technical ContextAI

Jackson is the de-facto JSON streaming and data-binding library for the Java ecosystem; jackson-core provides the low-level incremental parser/generator primitives beneath jackson-databind. To defend against abusive inputs, jackson-core 2.15+ introduced StreamReadConstraints, including a maxNestingDepth ceiling (default 500) that aborts parsing of pathologically nested structures. This CVE is a CWE-770 (resource allocation without limits/throttling) defect: in the 3.0.x line, two parser implementations - UTF8DataInputJsonParser, used when reading from a java.io.DataInput, and ReaderBasedJsonParser, used for character-stream (Reader) sources - never consult the maxNestingDepth guard, so nesting is bounded only by available JVM stack. Each nesting level consumes a stack frame during recursive structural processing, and once the stack is exhausted the JVM raises an unrecoverable StackOverflowError. The CPE cpe:2.3:a:fasterxml:jackson-core confirms the affected component is the core library itself, meaning any downstream consumer (including jackson-databind users) inherits the flaw.

RemediationAI

Vendor-released patch: 3.1.0 - upgrade jackson-core to 3.1.0 or later, which enforces maxNestingDepth in both UTF8DataInputJsonParser and ReaderBasedJsonParser; verify transitive pins so a framework BOM does not silently hold the library at 3.0.x. The fix is delivered in commit 8b25fd67f20583e75fb09564ce1eaab06cd5a902 / PR https://github.com/FasterXML/jackson-core/pull/1554, and details are in the advisory https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56r. If you cannot upgrade immediately, the most effective compensating control is to cap inbound request/body size at the edge (reverse proxy or API gateway) so deeply nested payloads cannot reach the parser - trade-off: legitimate large documents may be rejected, so size the limit to your real payloads. Where feasible, explicitly construct parsers with a tightened StreamReadConstraints maxNestingDepth and reject oversized inputs before parsing, and avoid feeding untrusted data through DataInput-backed parsing; note these controls do not fully substitute for the patch because the affected parsers ignore the constraint pre-3.1.0, so edge-side size/depth filtering is the reliable interim mitigation.