CVE-2026-86513
Description
A flaw was found in the JSON Pointer parser component of java-json-tools jackson-coreutils. A remote attacker could exploit this vulnerability by manipulating input to the TreePointer.tokensFromInput function, leading to excessive resource allocation. This could result in a Denial of Service (DoS) condition, making the affected system unavailable to legitimate users.
Statement
Red Hat Product Security rates this vulnerability as Moderate impact because an unauthenticated remote attacker can induce excessive resource consumption, but the blast radius is strictly confined to service degradation or availability disruption without risking confidentiality or integrity. In Red Hat environments, the issue only affects services that expose JSON Pointer processing interfaces directly to untrusted input. Systems that do not process untrusted pointer expressions or that enforce strict input size and rate controls are not vulnerable to significant service disruption.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other); Reduce Performance
This issue can make the product perform more slowly. If an attacker can influence the number of iterations in the loop, then this performance problem might allow a denial of service by consuming more platform resources than intended.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
