---
id: "CVE-2026-112072"
kind: "vulnerability"
aliases: ["CVE-2026-112072"]
title: "vault-java-driver: deeply nested JSON response crashes Java reading thread"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hashicorp-vault", "java", "kv-v2", "package", "vault"]
not_affected_if: ["no-untrusted-writers", "vault-1.20-or-later"]
published_at: "2026-11-05T08:17:03+00:00"
first_seen_at: "2026-11-05T08:38:02+00:00"
updated_at: "2026-11-05T08:39:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112072", "first_seen_at": "2026-11-05T08:38:02+00:00"}]
exploit_sources: []
---

# vault-java-driver: deeply nested JSON response crashes Java reading thread

The vault-java-driver Java client for HashiCorp Vault parses responses with a vendored JSON parser that has no nesting depth limit, so a deeply nested value raises a StackOverflowError that escapes normal exception handling and kills the thread. A token that can write but not read a KV v2 path can store such a value, so later reads of that path through the driver fail.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the version of `io.github.jopenlibs:vault-java-driver` in your build file (for example `pom.xml` or `build.gradle`).
- Check whether your Vault server is `1.19.x` or earlier, since the attack needs those versions.

## Fix

- `io.github.jopenlibs:vault-java-driver` upgrade to `7.0.0`

## Timeline

- 2026-11-05T08:38:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112072

## From the sources

vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_