CVE-2026-68498: Jackson Core denial of service via unbounded JSON property name allocation

CVE-2026-68498 · Severity: high · CVSS 7.5 · Published 2026-10-16

Jackson Core, a widely-used JSON parsing library, fails to enforce memory limits when parsing JSON object property names from text sources like Strings or Readers. An attacker sending specially crafted JSON with extremely long property names can force the parser to allocate hundreds of megabytes of memory, causing heap exhaustion and crashing the application. This can happen on the default configuration and requires no authentication.

Technologies: FasterXML Jackson-Core. Vendors: FasterXML.

Quick answers

Is CVE-2026-68498 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-68498 being exploited in the wild.
How severe is CVE-2026-68498?
High severity, with a CVSS score of 7.5, published 16 October 2026.
Which products and versions are affected?
FasterXML Jackson-Core 2.16.0 through 2.17.x; Tools.Jackson Jackson-Core 3.0.0 through 3.x.
Is there a fix for CVE-2026-68498?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-68498 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-68498?
Check whether you run FasterXML Jackson-Core or Tools.Jackson Jackson-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ReaderBasedJsonParser._parseName2() method accumulates JSON property names into a TextBuffer but uses the wrong length validation, checking against maxStringLength (100 MB default) instead of maxNameLength (50 KB default) until after the entire name is buffered. This allows an attacker to allocate up to approximately 200 MB per request through the character-input code path. Byte-input parsers (UTF8StreamJsonParser and others) correctly validate the constraint incrementally and are unaffected. The vulnerability exists in jackson-core 2.16.0+ and tools.jackson.core 3.0.0+ when parsing untrusted JSON from String, Reader, or char[] sources.

Affected products

  • FasterXML jackson-core 2.16.0 through 2.17.x
  • tools.jackson jackson-core 3.0.0 through 3.x

Timeline

  • 2026-10-16: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.