sonatype-2026-000642 Security Details

CVE ID

sonatype-2026-000642

CWE

N/A

CVE Description

jackson-core - Allocation of Resources Without Limits or Throttling

Published

Mar 2, 2026

CVSS Score & Severity

8.7High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

0%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase._finishFloatExponent(ZI)Lcom/fasterxml/jackson/core/JsonToken;

JVM

com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase._finishFloatFraction()Lcom/fasterxml/jackson/core/JsonToken;

JVM

com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase._finishNumberIntegralPart([CI)Lcom/fasterxml/jackson/core/JsonToken;

JVM

com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase._finishTokenWithEOF()Lcom/fasterxml/jackson/core/JsonToken;

JVM

com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase._startFloat([CII)Lcom/fasterxml/jackson/core/JsonToken;

JVM

com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase._startNegativeNumber()Lcom/fasterxml/jackson/core/JsonToken;

JVM

com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase._startPositiveNumber()Lcom/fasterxml/jackson/core/JsonToken;

JVM

com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase._startPositiveNumber(I)Lcom/fasterxml/jackson/core/JsonToken;

JVM

tools/jackson/core/json/async/NonBlockingUtf8JsonParserBase._finishFloatExponent(ZI)Ltools/jackson/core/JsonToken;

JVM

tools/jackson/core/json/async/NonBlockingUtf8JsonParserBase._finishFloatFraction()Ltools/jackson/core/JsonToken;

JVM

tools/jackson/core/json/async/NonBlockingUtf8JsonParserBase._finishNumberIntegralPart([CI)Ltools/jackson/core/JsonToken;

JVM

tools/jackson/core/json/async/NonBlockingUtf8JsonParserBase._finishTokenWithEOF()Ltools/jackson/core/JsonToken;

JVM

tools/jackson/core/json/async/NonBlockingUtf8JsonParserBase._startFloat([CII)Ltools/jackson/core/JsonToken;

JVM

tools/jackson/core/json/async/NonBlockingUtf8JsonParserBase._startNegativeNumber()Ltools/jackson/core/JsonToken;

JVM

tools/jackson/core/json/async/NonBlockingUtf8JsonParserBase._startPositiveNumber()Ltools/jackson/core/JsonToken;

JVM

tools/jackson/core/json/async/NonBlockingUtf8JsonParserBase._startPositiveNumber(I)Ltools/jackson/core/JsonToken;

JVM

Affected Ecosystems

affected

Source

Sonatype

References

GitHub · Advisory · GHSA-72hv-8253-57qqPROJECT