Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-ubx4-dx4j-67dd |
|---|
| Summary | jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
### Summary
The `UTF8DataInputJsonParser`, which is used when parsing from a `java.io.DataInput` source, bypasses the `maxNestingDepth` constraint (default: 500) defined in `StreamReadConstraints`.
A similar issue was found in `ReaderBasedJsonParser`.
This allows a user to supply a JSON document with excessive nesting, which can cause a `StackOverflowError` when the structure is processed, leading to a Denial of Service (DoS).
The related fix for com.fasterxml.jackson.core:jackson-core, CVE-2025-52999, was not fully applied to tools.jackson.core:jackson-core until the 3.1.0 release. It is recommended that 3.0.x users upgrade.
### Patches
jackson-core contains a configurable limit for how deep Jackson will traverse in an input document. This check was missing in a few places in tools.jackson.core:jackson-core.
The change is in https://github.com/FasterXML/jackson-core/pull/1554. jackson-core will throw a StreamConstraintsException if the limit is reached.
jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs.
### Workarounds
Users should avoid parsing input files from untrusted sources.
### Resources
[GHSA-6v53-7c9g-w56r](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56r)
https://nvd.nist.gov/vuln/detail/CVE-2025-52999
https://github.com/FasterXML/jackson-core/pull/1554 |
|---|
| Aliases |
| 0 |
|
| 1 |
| alias |
GHSA-6v53-7c9g-w56r |
|
|
|---|
| Fixed_packages |
|
|---|
| Affected_packages |
|
|---|
| References |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-29062 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00018 |
| scoring_system |
epss |
| scoring_elements |
0.04582 |
| published_at |
2026-04-02T12:55:00Z |
|
| 1 |
| value |
0.00018 |
| scoring_system |
epss |
| scoring_elements |
0.04603 |
| published_at |
2026-04-04T12:55:00Z |
|
| 2 |
| value |
0.0002 |
| scoring_system |
epss |
| scoring_elements |
0.05198 |
| published_at |
2026-04-18T12:55:00Z |
|
| 3 |
| value |
0.0002 |
| scoring_system |
epss |
| scoring_elements |
0.05196 |
| published_at |
2026-04-16T12:55:00Z |
|
| 4 |
| value |
0.0002 |
| scoring_system |
epss |
| scoring_elements |
0.05251 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.0002 |
| scoring_system |
epss |
| scoring_elements |
0.05264 |
| published_at |
2026-04-12T12:55:00Z |
|
| 6 |
| value |
0.0002 |
| scoring_system |
epss |
| scoring_elements |
0.05279 |
| published_at |
2026-04-11T12:55:00Z |
|
| 7 |
| value |
0.0002 |
| scoring_system |
epss |
| scoring_elements |
0.05314 |
| published_at |
2026-04-09T12:55:00Z |
|
| 8 |
| value |
0.0002 |
| scoring_system |
epss |
| scoring_elements |
0.05293 |
| published_at |
2026-04-08T12:55:00Z |
|
| 9 |
| value |
0.0002 |
| scoring_system |
epss |
| scoring_elements |
0.05258 |
| published_at |
2026-04-07T12:55:00Z |
|
| 10 |
| value |
0.0002 |
| scoring_system |
epss |
| scoring_elements |
0.05391 |
| published_at |
2026-04-24T12:55:00Z |
|
| 11 |
| value |
0.0002 |
| scoring_system |
epss |
| scoring_elements |
0.05353 |
| published_at |
2026-04-21T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-29062 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
|
|---|
| Weaknesses |
| 0 |
| cwe_id |
770 |
| name |
Allocation of Resources Without Limits or Throttling |
| description |
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. |
|
| 1 |
| cwe_id |
1284 |
| name |
Improper Validation of Specified Quantity in Input |
| description |
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
|
| 2 |
| cwe_id |
937 |
| name |
OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities |
| description |
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013. |
|
| 3 |
| cwe_id |
1035 |
| name |
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| description |
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017. |
|
|
|---|
| Exploits |
|
|---|
| Severity_range_score | 7.0 - 8.9 |
|---|
| Exploitability | 0.5 |
|---|
| Weighted_severity | 8.0 |
|---|
| Risk_score | 4.0 |
|---|
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-ubx4-dx4j-67dd |
|---|