CVE-2026-29062

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.

• CWE-770
• CWE-1284

• https://github.com/FasterXML/jackson-core/commit/8b25fd67f20583e75fb09564ce1eaab06cd5a902Patch
• https://github.com/FasterXML/jackson-core/pull/1554Issue Tracking, Patch
• https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56rPatch, Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-29062
• https://bugzilla.redhat.com/show_bug.cgi?id=2445135
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29062.json

Published

Mar 6, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29057Next.js is a React framework for building full-stack web app…6.5
• CVE-2026-29058AVideo is a video-sharing Platform software. Prior to versio…9.8
• CVE-2026-29059Windmill is an open-source developer platform for internal c…7.5
• CVE-2026-2906A security flaw has been discovered in Tenda HG9 300001138. …8.8
• CVE-2026-29060Gokapi is a self-hosted file sharing server with automatic e…5
• CVE-2026-29061Gokapi is a self-hosted file sharing server with automatic e…5.4
• CVE-2026-29063Immutable.js provides many Persistent Immutable data structu…9.8
• CVE-2026-29064Zarf is an Airgap Native Packager Manager for Kubernetes. Fr…8.2
• CVE-2026-29065changedetection.io is a free open source web page change det…9.1
• CVE-2026-29066Tina is a headless content management system. Prior to 2.1.8…6.2
• CVE-2026-29067ZITADEL is an open source identity management platform. From…9.3
• CVE-2026-29068PJSIP is a free and open source multimedia communication lib…7.5