{"id":"CVE-2026-112072","kind":"vulnerability","aliases":["CVE-2026-112072"],"related":[],"title":"vault-java-driver: deeply nested JSON response crashes Java reading thread","description":"vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0.","summary":"The vault-java-driver Java client for HashiCorp Vault parses responses with a vendored JSON parser that has no nesting depth limit, so a deeply nested value raises a StackOverflowError that escapes normal exception handling and kills the thread. A token that can write but not read a KV v2 path can store such a value, so later reads of that path through the driver fail.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hashicorp-vault","java","kv-v2","package","vault"],"not_affected_if":["no-untrusted-writers","vault-1.20-or-later"],"how_to_check":"- Check the version of `io.github.jopenlibs:vault-java-driver` in your build file (for example `pom.xml` or `build.gradle`).\n- Check whether your Vault server is `1.19.x` or earlier, since the attack needs those versions.","fix":"- `io.github.jopenlibs:vault-java-driver` upgrade to `7.0.0`","status":"open","published_at":"2026-11-05T08:17:03+00:00","first_seen_at":"2026-11-05T08:38:02+00:00","triaged_at":"2026-11-05T08:39:50+00:00","updated_at":"2026-11-05T08:39:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T08:39:50Z","model":"claude-haiku-5-5","output":{"fix":"- `io.github.jopenlibs:vault-java-driver` upgrade to `7.0.0`","reach":"network","title":"vault-java-driver: deeply nested JSON response crashes Java reading thread","impact":"low","summary":"The vault-java-driver Java client for HashiCorp Vault parses responses with a vendored JSON parser that has no nesting depth limit, so a deeply nested value raises a StackOverflowError that escapes normal exception handling and kills the thread. A token that can write but not read a KV v2 path can store such a value, so later reads of that path through the driver fail.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","vault","hashicorp-vault","kv-v2"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Reading thread crashes repeatedly on a stored value, breaking later reads.","analyst_note":"","how_to_check":"- Check the version of `io.github.jopenlibs:vault-java-driver` in your build file (for example `pom.xml` or `build.gradle`).\n- Check whether your Vault server is `1.19.x` or earlier, since the attack needs those versions.\n- unknown for anything else.","plain_action":"","needs_analyst":false,"not_affected_if":["vault-1.20-or-later","no-untrusted-writers"],"who_is_affected":"Applications that use the vault-java-driver library to read secrets from HashiCorp Vault, in versions 5.2.0 through 6.2.3. The attack needs a Vault token that can write to a KV v2 path but cannot read it, and a Vault server at 1.19.x or earlier, since 1.20 and later reject deeply nested values. Teams on Vault 1.20 or later, or who do not let untrusted writers store values in paths their services read, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000771,"input_tokens":4361,"output_tokens":669,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112072':15A,18A '-2026':14A,17A '1.19':173C '1.20':178C '298':186C '5.2.0':196C '6.2.3':198C '7.0.0':203C 'affect':190C 'catch':132C 'client':34B,101C 'crash':9A 'cve':13A,16A 'deeper':184C 'deepli':5A,53B,124C 'depth':49B,121C 'driver':4A,32B,93B,98C,168C,195C 'earlier':176C 'escap':60B,131C 'everi':160C 'except':62B,133C 'fail':94B,169C 'fix':201C 'handl':63B 'handler':134C 'hashicorp':20B,36B,103C 'hashicorp-vault':19B 'io.github.jopenlibs':191C 'issu':189C 'java':3A,10A,22B,31B,33B,97C,100C,194C 'json':7A,43B,108C,115C 'kill':65B,136C 'kv':24B,77B,150C 'kv-v2':23B 'later':86B,161C,180C 'level':187C 'limit':50B,122C 'minim':114C 'minimal-json':113C 'nest':6A,48B,54B,120C,125C,183C 'normal':61B 'packag':26B 'pars':38B,105C 'parser':44B,116C 'path':79B,90B,152C,165C 'rais':56B,127C 'read':11A,75B,87B,138C,148C,162C 'reject':181C 'requir':171C 'respons':8A,39B,109C 'stackoverflowerror':58B,129C 'store':81B,154C 'thread':12A,67B,139C 'token':69B,142C 'v2':25B,78B,151C 'valu':55B,84B,126C,157C,182C 'vault':2A,21B,27B,30B,37B,96C,104C,106C,141C,172C,193C 'vault-java-driv':1A,29B,95C,192C 'vendor':42B,112C 'write':72B,145C 'x':174C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the vault-java-driver library to read secrets from HashiCorp Vault, in versions 5.2.0 through 6.2.3. The attack needs a Vault token that can write to a KV v2 path but cannot read it, and a Vault server at 1.19.x or earlier, since 1.20 and later reject deeply nested values. Teams on Vault 1.20 or later, or who do not let untrusted writers store values in paths their services read, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hashicorpvault","java","kvv2","medium","package","vault"],"campaign_type":null,"first_public_at":"2026-11-05T08:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"abd028dc-c042-4c4d-9749-38d0f850af89","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112072","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112072","severity":null,"published_at":"2026-11-05T08:17:03+00:00","modified_at":"2026-11-05T08:17:03+00:00","first_seen_at":"2026-11-05T08:38:02+00:00","fetched_at":"2026-11-05T08:38:02+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}