CVE-2026-86511

MEDIUMCVSS 5.3

Description

A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consumption. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Timeline

Published:September 8th, 2026 3:17 AM

Last modified:September 8th, 2026 3:17 AM

CVSS Scoring

CVSS v3: 5.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS v2: 5.0

Weaknesses (CWE)

CWE-400 CWE-404

References & Reports

Advisories, patches, and third-party reports

https://github.com/java-json-tools/jackson-coreutils/
https://github.com/java-json-tools/jackson-coreutils/issues/65
https://vuldb.com/cve/CVE-2026-86511
https://vuldb.com/submit/908322
https://vuldb.com/vuln/399664
https://vuldb.com/vuln/399664/cti

Source: NIST NVD · Data may lag official sources by up to one minute