CVE-2026-86321

MediumCVSS 5.3/10Last modified Sep 8, 2026

Description

A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
java-json-tools	jackson-coreutils	2.0

References

Timeline

Published: Sep 7, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-863228.8A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target ac CVE-2026-863234.3A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources CVE-2026-863244.3A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user CVE-2026-863259.4A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insuff CVE-2026-863268.6An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify th CVE-2026-86339.8IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Appli CVE-2026-863307.2An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible CVE-2026-863326.5A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes CVE-2026-863344.2Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on CVE-2026-863356.3Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to acces CVE-2026-86336Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured CVE-2026-863386.0Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced i