CVE-2026-29062: 
Java vulnerability analysis and mitigation

CVE-2026-29062 is a Denial of Service vulnerability in tools.jackson.core:jackson-core caused by a nesting depth constraint bypass in UTF8DataInputJsonParser and ReaderBasedJsonParser. It affects versions 3.0.0 through 3.0.x (before 3.1.0) of the tools.jackson.core artifact — the Jackson 3.x repackaged library — and does not affect the older com.fasterxml.jackson.core:jackson-core 2.x line. The vulnerability was disclosed on March 3, 2026, published to the GitHub Advisory Database on March 4, 2026, and to the NVD on March 6, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-1284 (Improper Validation of Specified Quantity in Input). In UTF8DataInputJsonParser, when creating child array or object contexts, the code directly assigned the result of _streamReadContext.createChildArrayContext() / createChildObjectContext() without routing through the depth-checking wrapper methods (createChildArrayContext(row, col) / createChildObjectContext(row, col)), effectively bypassing the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. The same bypass existed in ReaderBasedJsonParser. This is a regression introduced in the 3.0.x line; the analogous fix for the 2.x artifact (CVE-2025-52999) was not fully ported. An unauthenticated attacker can exploit this by submitting a JSON document with nesting depth exceeding 500 levels (e.g., 5,000 nested arrays), triggering a StackOverflowError during parsing. The fix, merged in PR #1554, replaces the direct context assignment calls with the proper depth-checking helper methods (GitHub Advisory, Patch Commit).

Successful exploitation causes a StackOverflowError in the JVM thread processing the malicious JSON input, crashing the parsing operation and rendering the affected service unavailable — a pure availability impact with no confidentiality or integrity consequences. Any application using tools.jackson.core:jackson-core 3.0.x that parses JSON from a java.io.DataInput source or via ReaderBasedJsonParser is affected, including downstream consumers such as jackson-databind. IBM Maximo Application Suite and IBM Process Mining are among the confirmed affected enterprise products. Repeated exploitation can sustain a denial-of-service condition against the targeted service (GitHub Advisory, IBM Advisory).

1. Identify target: Locate a service that accepts JSON input and uses tools.jackson.core:jackson-core version 3.0.0–3.0.x (e.g., a REST API endpoint that parses a request body via Jackson).
2. Craft malicious payload: Construct a JSON document with nesting depth significantly exceeding 500 levels. For example, generate a deeply nested array structure: [[[[... (5000 levels) ...]]]] or equivalent nested objects {"a":{"a":{...}}} at 5,000+ levels deep.
3. Submit the payload: Send the crafted JSON document to the target endpoint via an HTTP POST (or any other method that causes the server to parse the JSON using UTF8DataInputJsonParser or ReaderBasedJsonParser), e.g.:

   POST /api/endpoint HTTP/1.1
   Content-Type: application/json
   
   [[[[...5000 nested arrays...]]]]  

4. Trigger StackOverflowError: The parser processes the nested structure recursively without enforcing the maxNestingDepth limit, causing a StackOverflowError in the JVM thread, which crashes the request handler and may take down the service or cause repeated thread failures under load.
5. Sustain DoS: Repeat the request to maintain the denial-of-service condition, as each request independently triggers the overflow (GitHub Advisory, Patch Commit).

• Logs: JVM crash logs or application logs containing java.lang.StackOverflowError stack traces originating from tools.jackson.core.json.UTF8DataInputJsonParser or tools.jackson.core.json.ReaderBasedJsonParser; repeated HTTP 500 errors on JSON-consuming endpoints correlated with large or deeply structured request bodies.
• Network: Inbound HTTP requests with unusually large JSON payloads (e.g., many kilobytes of repeated bracket characters [ or {) to API endpoints; high request rates to the same endpoint from a single source IP.
• Process: JVM thread dumps showing threads stuck in deep recursive call stacks within Jackson parser classes; sudden service restarts or OOM/crash events in Java application servers (Tomcat, Jetty, Spring Boot, etc.) processing JSON.

The primary remediation is to upgrade tools.jackson.core:jackson-core from any 3.0.x version to 3.1.0 or later, which contains the fix introduced in PR #1554. IBM Process Mining and IBM Maximo Application Suite users should apply the respective IBM security interim fixes released in April 2026 or later. As a temporary workaround where upgrading is not immediately possible, avoid parsing JSON from untrusted or unauthenticated sources, and consider placing an API gateway or WAF in front of affected services to reject abnormally large or deeply nested JSON payloads (GitHub Advisory, IBM Advisory, Atlassian Bulletin).

Atlassian included this CVE in its May 19, 2026 security bulletin addressing multiple vulnerabilities across Bamboo, Confluence, and related products, which received coverage from Heise and security aggregators (Atlassian Bulletin). IBM issued advisories for both IBM Process Mining and IBM Maximo Application Suite in April 2026 (IBM Advisory). Community reaction has been largely routine, with numerous Dependabot alerts automatically filed across open-source Java projects using tools.jackson.core:jackson-core 3.0.x, reflecting broad downstream impact of the dependency.