CVE-2026-86321 Details
Description
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
A server-side request forgery (SSRF) vulnerability has been identified in Jackson-Coreutils version 2.0. The issue arises in the JsonLoader.fromURL function, which lacks proper URL validation, allowing attacker-controlled URLs to be processed. This vulnerability can be exploited remotely, potentially leading to unauthorized access to internal services or files.
Users are advised to validate URLs before using them in the JsonLoader.fromURL() method. Additionally, Jackson should be upgraded to version 2.15 or later, which includes improvements for handling large BigDecimal values.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/java-json-tools/jackson-coreutils/ | [email protected] | ProductSource CodeVendor |
| https://github.com/java-json-tools/jackson-coreutils/issues/64 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-86321 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/908323 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399511 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/399511/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| java-json-tools jackson-coreutils | 2.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | [email protected] |