CVE-2026-112072

    Dashboard / Vulnerabilities / CVE-2026-112072

    CVE-2026-112072

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: vault-java-driver: stored deeply nested JSON kills every thread that reads it

    Details: vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0.

    References: https://repo.maven.apache.org/maven2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112072.json, https://nvd.nist.gov/vuln/detail/CVE-2026-112072, https://github.com/jopenlibs/vault-java-driver/pull/81, https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/, https://github.com/jopenlibs/vault-java-driver

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ff8b2d08adf8643dfb751ae04934e230a98172ea
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-112072 | CVE-DB