CVE-2026-29062: jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
(updated )
The UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints.
A similar issue was found in ReaderBasedJsonParser.
This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS).
The related fix for com.fasterxml.jackson.core:jackson-core, CVE-2025-52999, was not fully applied to tools.jackson.core:jackson-core until the 3.1.0 release. It is recommended that 3.0.x users upgrade.
References
- github.com/FasterXML/jackson-core
- github.com/FasterXML/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaab06cd5a902
- github.com/FasterXML/jackson-core/pull/1554
- github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56r
- github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3
- github.com/advisories/GHSA-6v53-7c9g-w56r
- nvd.nist.gov/vuln/detail/CVE-2025-52999
- nvd.nist.gov/vuln/detail/CVE-2026-29062
Code Behaviors & Features
Detect and mitigate CVE-2026-29062 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →