CVE-2026-86513 Details

A denial-of-service vulnerability has been identified in the Java-Json-Tools Jackson-Coreutils library, specifically in version 2.0. The issue arises in the JSON Pointer parser within the TreePointer.tokensFromInput function. This vulnerability can be exploited remotely and has been made public. It involves two resource exhaustion problems: quadratic CPU consumption and unbounded memory allocation. The CPU issue stems from the parser's use of iterative substring calls, which create inefficiencies that can be exploited. The memory problem occurs because parsed tokens are added to an ArrayList without any capacity limits, leading to potential OutOfMemoryErrors.

The vulnerability can be fixed by replacing the current substring-based token parsing approach with a more efficient index-based method that only copies individual segments. Additionally, implementing a maximum segment count limit can prevent unbounded memory growth.