CVE-2026-86321: Server-Side Request Forgery in java-json-tools jackson-coreutils

The vulnerability CVE-2026-86321 affects the jackson-coreutils component of java-json-tools, specifically the JsonLoader.fromURL function in src/main/java/com/github/fge/jackson/JsonLoader.java. This flaw allows an attacker to perform server-side request forgery by manipulating URL validation, enabling the server to send crafted requests to arbitrary URLs. The issue is remotely exploitable without any privileges or user interaction. The project was notified early but has not issued a fix or response. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server to internal or external systems. This could lead to information disclosure or interaction with internal services that are otherwise inaccessible. However, no direct code execution or privilege escalation is indicated. The medium severity reflects the potential impact balanced against the lack of privilege or user interaction requirements.

No official fix or patch is currently available from the vendor. Since the project has not responded yet, users should monitor the vendor's channels for updates. Until a patch is released, consider implementing network-level controls to restrict outbound requests from the affected system to trusted destinations only, thereby mitigating the risk of SSRF exploitation.