CVE-2026-29062 jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
Attackers can cause a Denial of Service in applications using jackson-core by supplying deeply nested JSON that bypasses nesting limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29062?
CVE-2026-29062 is a high-severity denial of service vulnerability in FasterXML jackson-core, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.
Which versions are affected by CVE-2026-29062?
2 open source packages ship an affected version, including tools.jackson.core:jackson-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tools.jackson.core:jackson-core Maven | From 3.0.0 | 3.1.0 |
tools.jackson.core:jackson-core Maven | From 3.0.0 | 3.1.0 |
Products include Fasterxml Jackson-Core.
How do I fix CVE-2026-29062?
Upgrade tools.jackson.core:jackson-core to 3.1.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-29062 being exploited?
There is no known exploitation of CVE-2026-29062 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-DS38629, CLEANSTART-2026-TD10342, CLEANSTART-2026-ZD94014, ECHO-1b7a-451d-1afc, GHSA-6v53-7c9g-w56r, MINI-44wg-rqmc-mqwp and 8 more.