CVE-2026-86513 java-json-tools CVE debrief

Who should care

Defenders responsible for java-json-tools jackson-coreutils 2.0 deployments should assess exposure and prioritize verification of inventory and potential impact. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, defenders should monitor for potential exploitation attempts and track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact on their systems.

• Verify the presence of this vulnerability in your inventory
• Assess the potential impact on your systems
• Monitor for potential exploitation attempts

Technical summary

The vulnerability affects the function TreePointer.tokensFromInput of the file src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java of the component JSON Pointer parser in java-json-tools jackson-coreutils 2.0. The manipulation results in allocation of resources. The attack can be executed remotely. This vulnerability has been publicly disclosed and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact on their systems.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact on their systems.

Recommended defensive actions

• Verify the presence of this vulnerability in your inventory
• Assess the potential impact on your systems
• Monitor for potential exploitation attempts
• Apply vendor patches or updates if available
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The project was informed of the problem early through an issue report but has not responded yet. Defenders should verify the presence of this vulnerability in their inventory and assess the potential impact on their systems. The vulnerability affects the function TreePointer.tokensFromInput of the file src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java of the component JSON Pointer parser in java-json-tools jackson-coreutils 2.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.