Skip to content

Max Depth validation not working for DataInput-backed JsonParsers in 3.0 [CVE-2026-29062] #1553

Closed
Closed
Max Depth validation not working for DataInput-backed JsonParsers in 3.0 [CVE-2026-29062]#1553
Labels
3.1cveIssues related to public CVEs (security vuln reports)processing-limitsIssues related to limiting aspects of input/output that can be processed without exception
Milestone
3.1.0

Description

@cowtowncoder
cowtowncoder
opened on Feb 19, 2026

StreamReadConstraints.maxNestingDepth setting is not being validated in 3.0 by JsonParsers created for DataInput -- this is regression from 2.x where constraints validation works.

Reported by @sprabhav7, @rohan-repos.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.1cveIssues related to public CVEs (security vuln reports)processing-limitsIssues related to limiting aspects of input/output that can be processed without exception

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions