CVE-2026-29062

CVE-2026-29062 affects jackson-core: from 3.0.0 up to before 3.1.0, the UTF8DataInputJsonParser (used when parsing from java.io.DataInput) bypasses the StreamReadConstraints maxNestingDepth (default 500), allowing excessively nested JSON to cause a StackOverflowError and a resulting DoS. A simila...