CVE-2026-86321

Publié : 7 septembre 2026

Modifié : 7 septembre 2026

Score CVSS

5.3

MEDIUM

Description détaillée

A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Références et Patchs

https://github.com/java-json-tools/jackson-coreutils/https://github.com/java-json-tools/jackson-coreutils/issues/64 https://vuldb.com/cve/CVE-2026-86321 https://vuldb.com/submit/908323 https://vuldb.com/vuln/399511 https://vuldb.com/vuln/399511/cti

Dernières Vulnérabilités

CVE-2026-86506

In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data

VOIR DÉTAILS

CVE-2026-86505

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace

VOIR DÉTAILS

CVE-2026-86504

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution

VOIR DÉTAILS