FasterXML jackson-core DoS via number length limit bypass in async parser

Executive brief

A vulnerability in the Jackson JSON library's non-blocking (async) parser allows attackers to bypass safety limits on the length of numbers in JSON data. By sending extremely long numbers, an attacker can cause the application to consume excessive memory or CPU resources, potentially leading to a denial-of-service (DoS) condition where the service becomes unavailable. This affects applications using reactive frameworks like Spring WebFlux that rely on asynchronous JSON processing.

Technical details

A resource exhaustion vulnerability exists in jackson-core's async parsing implementation, specifically within NonBlockingUtf8JsonParserBase. While the synchronous parser correctly enforces the maxNumberLength constraint from StreamReadConstraints, the async path fails to call the validation methods (resetInt and resetFloat) during number parsing. An attacker can provide a JSON document with arbitrarily long numeric values to trigger unbounded memory allocation in the TextBuffer. Furthermore, if the application attempts to process these large numbers using getBigIntegerValue() or getDecimalValue(), it can lead to O(n^2) CPU exhaustion. Patches are available in versions 2.18.6, 2.21.1, and 3.1.0.

Affected products

• FasterXML jackson-core >= 2.15.0, <= 2.18.5
• FasterXML jackson-core >= 2.19.0, < 2.21.1
• tools.jackson.core jackson-core >= 3.0.0, < 3.1.0

Timeline

• 2026-02-26: disclosed
• 2026-02-28: advisory

References

• https://api.github.com/users/sprabhav7
• https://github.com/sprabhav7
• https://api.github.com/users/sprabhav7/gists%7B/gist_id%7D
• https://api.github.com/users/sprabhav7/repos
• https://avatars.githubusercontent.com/u/122600613?v=4
• https://api.github.com/users/sprabhav7/events%7B/privacy%7D