Description

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.

INFO

Published Date :

2026-03-06T07:14:25.059Z

Last Modified :

2026-03-06T07:14:25.059Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-29062 vulnerability.

Vendors Products
Fasterxml
  • Jackson
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-29062.

URL Resource
https://github.com/FasterXML/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaab06cd5a902 cve-icon cve-icon cve-icon
https://github.com/FasterXML/jackson-core/pull/1554 cve-icon cve-icon cve-icon
https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56r cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-29062 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-29062 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact