Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.7, published 21 July 2026.

Which products and versions are affected?

FasterXML Jackson-Core >= 3.0.0, = 3.2.0, < 3.2.1.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run FasterXML Jackson-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

FasterXML jackson-core memory exhaustion in async parser via chunked digits

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run FasterXML Jackson-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 8.7 · Published 2026-07-21

Jackson-core is a widely used Java library for processing JSON data, often utilized by web frameworks like Spring WebFlux and Quarkus. A flaw in its asynchronous data parser allows an attacker to send specially crafted, extremely long numbers in small chunks to exhaust a server's memory. This can lead to a denial-of-service (DoS) condition where the application crashes or becomes unresponsive, even if administrators have set limits on maximum number lengths.

Technologies: FasterXML Jackson-Core. Vendors: FasterXML.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.7, published 21 July 2026.
Which products and versions are affected?: FasterXML Jackson-Core >= 3.0.0, < 3.1.4, >= 3.2.0, < 3.2.1.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run FasterXML Jackson-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a resource exhaustion issue (CWE-770) in `NonBlockingUtf8JsonParserBase.java`. While a previous fix (GHSA-72hv-8253-57qq) added length validation when a number is completed, it failed to validate the length of the internal `TextBuffer` when the parser returns `NOT_AVAILABLE` during chunked input. An attacker can stream a continuous sequence of digits without a terminator, causing the buffer to expand up to the `maxStringLength` (default 20MB) instead of being capped by `maxNumberLength` (default 1000). This allows for significant memory amplification per connection. The issue specifically affects reactive/non-blocking stacks using `JsonFactory.createNonBlockingByteArrayParser()`. Patches are available in versions 2.18.8, 2.21.4, 2.22.1, 3.1.4, and 3.2.1.

Affected products

FasterXML jackson-core < 2.18.8, >= 2.19.0, < 2.21.4, >= 2.22.0, < 2.22.1
tools.jackson.core jackson-core >= 3.0.0, < 3.1.4, >= 3.2.0, < 3.2.1

Timeline

2026-02-28: other: Parent advisory GHSA-72hv-8253-57qq published
2026-07-10: advisory: GitHub Advisory published
2026-07-21: disclosed: Full technical details and PoC disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.