Description

A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java of the component JSON Pointer parser. The manipulation results in allocation of resources. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-08T03:17:19.613Z",
  "pubdate": "2026-09-08T03:17:19.613Z",
  "executiveSummary": "A critical resource exhaustion vulnerability exists within the jackson-coreutils library, specifically in the JSON Pointer parsing logic. The flaw resides in the TreePointer.tokensFromInput function, where improper handling of input data during pointer tokenization leads to uncontrolled resource allocation. This vulnerability is remotely exploitable, allowing an unauthenticated attacker to trigger excessive memory consumption or CPU cycles by providing a crafted JSON Pointer input. Given that the exploit is publicly available and the project maintainers have remained unresponsive to disclosure, the risk of exploitation is high. Successful execution of this attack can result in a Denial of Service (DoS) condition, effectively crashing the application or rendering it unresponsive, thereby impacting service availability. Organizations relying on this library for JSON manipulation are at risk of remote service disruption.",
  "technicalDetails": "The vulnerability is located in the src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java file within the jackson-coreutils 2.0 library. The core issue stems from the TreePointer.tokensFromInput function, which is responsible for parsing JSON Pointer strings into their constituent tokens for tree navigation. During the tokenization process, the function fails to implement sufficient bounds checking or complexity constraints on the input string provided by the user.\nThe attack flow begins when an attacker transmits a maliciously crafted JSON Pointer string to an application utilizing this library. When the input reaches the tokensFromInput method, the parser fails to properly validate the structure or depth of the pointer. An attacker can supply a specially formatted string designed to force the parser into an inefficient processing state. Because the implementation performs resource allocation linked to the size or complexity of the parsed tokens without adequate limit enforcement, the attacker can induce a large number of allocations or sustain a long-running parsing loop.\nSpecifically, the root cause is an algorithmic complexity issue combined with an lack of input sanitization, which translates into uncontrolled resource consumption. As the parser recursively or iteratively builds the token structure, the memory pressure on the Java Virtual Machine (JVM) increases linearly or exponentially depending on the input structure. If the application processes this input without input length validation or timeout mechanisms, the heap memory usage can rapidly exceed defined thresholds, triggering OutOfMemoryError exceptions or inducing severe latency through aggressive Garbage Collection (GC) cycles.\nThe vulnerability is remotely exploitable, requiring no prior authentication or specific privilege level, provided the attacker can submit input that is subsequently processed by the vulnerable function. Since the exploit is publicly available, threat actors can weaponize this by sending simple, malformed requests that cause immediate resource exhaustion. Post-exploitation, the primary impact is a Denial of Service. Because the library handles fundamental JSON structure parsing, the impact is pervasive for any application that accepts untrusted input and passes it to the affected JSON Pointer parser. The absence of a patch necessitates defensive measures at the application layer to mitigate the potential for service degradation."
}