CVE-2026-85278

Overview

jackson-dataformat-toml is the TOML backend of the FasterXML Jackson suite, released from the jackson-dataformats-text repository alongside the CSV, Java Properties, and YAML backends. It builds a TOML parser and generator on top of Jackson's streaming and databind APIs, reading a TOML document into a Jackson tree that can then be bound to Java objects. Unlike the streaming YAML and Properties backends, the TOML backend materializes the whole document into an in-memory node tree before any token is handed to the caller, so every structure the document describes is allocated during parsing.

A Denial of Service (DoS) vulnerability (CVE-2026-85278) has been identified in the TOML parser's dotted-key handling, which allows attackers to force unbounded heap allocation by submitting a single TOML key made up of a very large number of dot-separated segments. Each segment creates another nested object node, and the configured StreamReadConstraints nesting-depth limit is never consulted on this path, so an application that has explicitly capped nesting depth still allocates roughly 600 bytes per level: a key with 100,000 segments costs on the order of 60 MB from a few hundred kilobytes of input.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may cease to be available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources it uses.

This issue affects TOML document parsing in the jackson-dataformat-toml module of Jackson.

‍

Details

Module Info

• Product: Jackson
• Affected packages: com.fasterxml.jackson.dataformat:jackson-dataformat-toml, tools.jackson.dataformat:jackson-dataformat-toml
• Affected versions: com.fasterxml.jackson.dataformat:jackson-dataformat-toml: 2.13.5, 2.14.3, >=2.15.0 <2.18.10, >=2.19.0 <2.21.6; tools.jackson.dataformat:jackson-dataformat-toml: >=3.0.0 <3.1.6
• GitHub repository: https://github.com/FasterXML/jackson-dataformats-text
• Published packages: https://central.sonatype.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-toml
• Package manager: Maven
• Fixed in:
  
  • NES for Jackson patched releases on the 2.13.x, 2.14.x, and 2.15.x lines
  • OSS Jackson 2.18.10, 2.21.6, and 3.1.6

Vulnerability Info

This Medium-severity vulnerability is found in the jackson-dataformat-toml package in TOML key parsing of Jackson.

TOML allows a key to be written as a dotted path, so that a.b.c = "value" defines nested tables a and a.b before assigning the leaf. The parser handles this in Parser.parseAndEnterKey(), which loops over the dot-separated segments and materializes one object node per segment. The loop counts nothing and validates nothing about how far it has descended:

private FieldRef parseAndEnterKey(
        TomlObjectNode outer,
        boolean forTable
) throws IOException {
    TomlObjectNode node = outer;
    while (true) {
        if (node.closed) {
            throw errorContext.atPosition(lexer).generic("Object already closed");
        }
        // ... read the next key segment into `part` ...
        pollExpected(partToken, Lexer.EXPECT_INLINE_KEY);
        if (peek() != TomlToken.DOT_SEP) {
            return new FieldRef(node, part);
        }
        pollExpected(TomlToken.DOT_SEP, Lexer.EXPECT_INLINE_KEY);

        JsonNode existing = node.get(part);
        if (existing == null) {
            node = (TomlObjectNode) node.putObject(part);
        } else if (existing.isObject()) {
            node = (TomlObjectNode) existing;
        }
        // ... array-of-tables and error cases ...
    }
}

The only nesting-depth accounting in the affected releases lives in the generated JFlex lexer, which increments and validates a counter for the structural tokens that open a table, an array, or an inline table. A dotted key emits none of those tokens: it is a sequence of key parts separated by DOT_SEP, so the lexer's counter never moves and StreamReadConstraints.maxNestingDepth() is never checked. On the 2.13.x and 2.14.x lines the situation is broader still, because the TOML module there predates StreamReadConstraints and carries no nesting-depth enforcement of any kind.

Any application that parses TOML supplied by an untrusted party is reachable, including configuration upload endpoints, multi-format request bodies, and tooling that ingests user-provided manifests. Because the cost is paid in retained heap rather than stack, the effect is memory pressure and garbage-collection thrash across the process rather than a single caught exception, and a modest set of concurrent requests multiplies it. Setting a smaller maxNestingDepth does not help, which is the part most likely to surprise operators who have already hardened their Jackson configuration.

The upstream correction moves depth accounting out of the lexer and into the parser, threading an explicit depth through key, value, array, and inline-table parsing so that every descent, including each dotted-key segment, is validated against the configured stream read constraints.

This vulnerability was introduced in 2021 with Jackson 2.12.3.

‍

Mitigation

The affected 2.13.x, 2.14.x, and 2.15.x release lines are End-of-Life and will not receive community updates addressing this issue. Branch status is published on the project's own Jackson Releases page.

Users of the affected components should apply one of the following mitigations:

• Upgrade jackson-dataformat-toml to a currently supported release containing the fix, such as 2.18.10 or later.
• Reject or size-limit TOML documents from untrusted sources before they reach the parser, since the nesting-depth constraint does not cover the dotted-key path in affected versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• waydeshi (finder)