The vulnerability in java-json-tools jackson-coreutils 2.0 affects the BigDecimal.toPlainString function in src/main/java/com/github/fge/jackson/JacksonUtils.java. Manipulating this function leads to excessive resource consumption. The issue can be triggered remotely without any privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). The project was notified early but has not issued a fix or official remediation. Public exploit code exists, but no known exploitation in the wild has been reported.

Successful exploitation results in resource consumption which could degrade service availability or performance. The attack can be initiated remotely without authentication or user interaction, increasing the risk of denial-of-service conditions. No direct data compromise or code execution impact is described.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a patch is released, consider limiting exposure of the vulnerable component to untrusted networks or inputs to reduce risk.