Buffer overflow in jackson-core - CVE-2026-29062
Published: March 4, 2026
Vulnerability identifier: #VU123491
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-29062
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in UTF8DataInputJsonParser when parsing deeply nested JSON files. A remote attacker can pass a specially JSON data to the application and perform a denial of service attack.
Note, the vulnerability exists due to the fix for #VU112106 (CVE-2025-52999) has not been properly applied for the 3.x branch.
Affected software
jackson-core
Confluence Data Center
Jira Service Management Data Center
Jira Software Data Center
Bamboo Data Center
Confluence Data Center
Jira Service Management Data Center
Jira Software Data Center
Bamboo Data Center
How to mitigate CVE-2026-29062
Install updates from vendor's website.
jackson-core - update to 3.1.0
Confluence Data Center - update to 10.2.11
Jira Service Management Data Center - update to 11.3.5
Jira Software Data Center - update to 11.3.5
Bamboo Data Center - update to 12.1.7
Confluence Data Center - update to 10.2.11
Jira Service Management Data Center - update to 11.3.5
Jira Software Data Center - update to 11.3.5
Bamboo Data Center - update to 12.1.7