{"id":"CVE-2026-29062","summary":"jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion","details":"jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.","aliases":["GHSA-6v53-7c9g-w56r"],"modified":"2026-08-18T18:39:13.352723Z","published":"2026-03-06T07:14:25.059Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29062.json"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29062.json"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-29062"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29062.json"},{"type":"ADVISORY","url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29062"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445135"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaab06cd5a902"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-core/pull/1554"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/fasterxml/jackson-core","events":[{"introduced":"360d616bbb88253ea094ccd7f18ca0edd97417a9"},{"fixed":"f59c10646e6fd09f37d149bb97a9a956bc684e1e"},{"fixed":"8b25fd67f20583e75fb09564ce1eaab06cd5a902"}],"database_specific":{"cpe":"cpe:2.3:a:fasterxml:jackson-core:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.0.0"},{"fixed":"3.1.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["jackson-core-3.1.0-rc1","jackson-core-3.0.1","jackson-core-3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-29062.json","vanir_signatures_modified":"2026-08-18T18:39:13Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaab06cd5a902","target":{"file":"src/main/java/tools/jackson/core/json/ReaderBasedJsonParser.java","function":"nextLongValue"},"deprecated":false,"digest":{"function_hash":"326247284020626194434323018155566475384","length":608},"id":"CVE-2026-29062-20c63f86"},{"target":{"file":"src/main/java/tools/jackson/core/json/ReaderBasedJsonParser.java"},"deprecated":false,"digest":{"line_hashes":["106598388642092149696502331383068503923","204620921462451523413774005085969423639","180716100322387293269590543731856659374","283906855990894385819716516467722376364","187188503822829248896081005461419530957","15158339026804114596224432777733400949"],"threshold":0.9},"id":"CVE-2026-29062-35845038","signature_type":"Line","signature_version":"v1","source":"https://github.com/fasterxml/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaab06cd5a902"},{"id":"CVE-2026-29062-73dfa86d","signature_type":"Line","signature_version":"v1","source":"https://github.com/fasterxml/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaab06cd5a902","target":{"file":"src/main/java/tools/jackson/core/json/UTF8DataInputJsonParser.java"},"deprecated":false,"digest":{"line_hashes":["47064118745308996343494504160410257956","339400567955816820824523477418297348649","26697672791631637217850411446812417495","74382845753095711789314797927742753645","325278982214326274968870050095414048995","186219158683373422827514039400150262329","13902693782175789176071437772012481154"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"242685837317073554904933969900038536886","length":1157},"id":"CVE-2026-29062-95ba11b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaab06cd5a902","target":{"file":"src/main/java/tools/jackson/core/json/UTF8DataInputJsonParser.java","function":"_nextTokenNotInObject"}},{"source":"https://github.com/fasterxml/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaab06cd5a902","target":{"file":"src/test/java/tools/jackson/core/unittest/constraints/DeeplyNestedContentViaDataInputTest.java"},"deprecated":false,"digest":{"line_hashes":["215599766717561388635343676630774604316","329705086767451314484476724171093175668","158343529494388294969067357075074491863","333311793813694995632880320735379871385","40054179169258071714266792710942745686","120278701020340703058806280078714898650","70905355252088676332915369421251760476","76721354423948096528212925821152316228","232700084553059138830374193930248784536","47128824903726531482751174677100032276","28890002059479067830092511737270072147","74917910273239124165012140325667351114","47597228591732313235632398196541325670"],"threshold":0.9},"id":"CVE-2026-29062-9a991032","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}