Description

A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consumption. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-08T03:17:19.257Z",
  "pubdate": "2026-09-08T03:17:19.257Z",
  "executiveSummary": "A vulnerability has been identified in jackson-coreutils version 2.0, specifically within the com.github.fge.jackson.JacksonUtils.java file. The vulnerability involves an improper implementation of BigDecimal.toPlainString, which results in significant resource consumption when processing maliciously crafted input.\nThis vulnerability is classified as a Denial of Service (DoS) risk, as the computational complexity of the affected function can be exploited to cause excessive CPU and memory usage.\nThe attack vector is remote, allowing unauthenticated threat actors to trigger the condition without specific privileges. As a public exploit exists, the risk to affected systems is elevated. The project maintainers have been notified, but no patches or official responses have been issued to date.",
  "technicalDetails": "The vulnerability resides in the JacksonUtils.java component of the jackson-coreutils library. The issue originates from the manner in which the application invokes BigDecimal.toPlainString() during the deserialization or processing of JSON data structures containing numeric values with high precision or specific formatting.\nIn Java, the BigDecimal.toPlainString() method is designed to provide a string representation of a decimal value without scientific notation. When an attacker provides a specially crafted JSON input that contains an extremely large BigDecimal value, the underlying conversion process requires intensive computational cycles to compute the exact string representation. This behavior is susceptible to algorithmic complexity attacks, where the time taken to process the number scales poorly relative to the input size.\nThe attack flow proceeds as follows: 1) The attacker sends a crafted JSON payload containing a BigDecimal numeric string to an endpoint that utilizes jackson-coreutils for parsing. 2) The JacksonUtils logic intercepts this value and proceeds to call BigDecimal.toPlainString(). 3) The processing logic enters a high-CPU state attempting to expand the BigDecimal into a full string format, effectively saturating the thread or process. 4) By sending multiple concurrent requests, an attacker can exhaust server resources, leading to a Denial of Service condition.\nThis vulnerability is particularly dangerous because it does not require administrative privileges and can be triggered remotely via standard network protocols. The lack of input validation or limits on the scale/precision of BigDecimal objects processed by the library exacerbates the issue. Because the exploit is public, threat actors can automate the delivery of these payloads to degrade application performance or cause service downtime. The impact is primarily limited to system instability and resource starvation, but it significantly impacts the availability of any service relying on this library for JSON manipulation.\nThe affected version is strictly jackson-coreutils 2.0. No specific authentication is required to interact with the vulnerable parsing logic, making the attack surface the entirety of the network-exposed interface using this dependency."
}