jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion

Vulnerability

Overview

CVE-2026-29062 affects jackson-core versions 3.0.0 up to (but not including) 3.1.0. The UTF8DataInputJsonParser, used when parsing from a java.io.DataInput source, and the ReaderBasedJsonParser both bypass the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints [1][2]. This oversight allows a JSON document with excessive nesting to trigger a StackOverflowError during parsing, leading to a denial of service (DoS).

Exploitation

An attacker can exploit this by providing a deeply nested JSON payload to an application that uses the affected parser implementations. No special privileges are required if the application parses untrusted input. The attack surface includes any service that accepts JSON from external sources and uses jackson-core 3.x with DataInput or Reader-based parsing paths [2].

Impact

Successful exploitation results in a StackOverflowError, which typically terminates the parsing thread or crashes the JVM, causing a denial of service. This can disrupt availability of the affected service. A similar issue was previously addressed in jackson-core 2.x (CVE-2025-52999) by introducing configurable depth limits [3], but the 3.x branch introduced a regression in the specific parser implementations.

Mitigation

The vulnerability has been patched in jackson-core version 3.1.0 [1]. Users are strongly advised to upgrade to 3.1.0 or later. As a workaround, applications should avoid parsing JSON from untrusted sources or ensure that input is validated for excessive nesting before processing.