Read the docs
TI-2026-85380 Aliases CVE-2026-112072GHSA-g3p9-q9ch-26gc

Deeply nested JSON in vault-java-driver crashes threads that read it

Priority LOW 29CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-674.

Summary

The jopenlibs vault-java-driver Java client for HashiCorp Vault is affected from 5.2.0 before 7.0.0. Its vendored JSON parser has no nesting depth limit (CWE-674), so a deeply nested value causes a StackOverflowError that escapes catch handlers and kills the reading thread. A token that can write but not read a KV v2 path can store such a value, and later reads of that path fail on Vault 1.19.x or earlier.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00327 25th percentileScored 2026-11-07
Fix Fixed vault-java-driver (jopenlibs): 7.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jopenlibsvault-java-driver5.2.0 to before 7.0.07.0.0Patch availableCNA
  • vault-java-driver Vendorjopenlibs Affected 5.2.0 to before 7.0.0 Fixed in 7.0.0 Patch available CNA

Remediation

Upgrade io.github.jopenlibs:vault-java-driver to version 7.0.0, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA vault-java-driver (jopenlibs) Fixed in 7.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    jopenlibs vault-java-driver 7.0.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-85379 vault-java-driver silently disables requested TLS verificationPriority LOW 34
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-112072
  2. 2026-11-05 Alias added: GHSA-g3p9-q9ch-26gc
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: MEDIUM → LOW
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Patch 2

  • TI-2026-85379 vault-java-driver silently disables requested TLS verification CVSS 3.1HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences