Executive brief
Jackson-core is a widely used Java library for processing JSON data, often utilized by web frameworks like Spring WebFlux and Quarkus. A flaw in its asynchronous data parser allows an attacker to send specially crafted, extremely long numbers in small chunks to exhaust a server's memory. This can lead to a denial-of-service (DoS) condition where the application crashes or becomes unresponsive, even if administrators have set limits on maximum number lengths.
Technical details
The vulnerability is a resource exhaustion issue (CWE-770) in `NonBlockingUtf8JsonParserBase.java`. While a previous fix (GHSA-72hv-8253-57qq) added length validation when a number is completed, it failed to validate the length of the internal `TextBuffer` when the parser returns `NOT_AVAILABLE` during chunked input. An attacker can stream a continuous sequence of digits without a terminator, causing the buffer to expand up to the `maxStringLength` (default 20MB) instead of being capped by `maxNumberLength` (default 1000). This allows for significant memory amplification per connection. The issue specifically affects reactive/non-blocking stacks using `JsonFactory.createNonBlockingByteArrayParser()`. Patches are available in versions 2.18.8, 2.21.4, 2.22.1, 3.1.4, and 3.2.1.
Affected products
- FasterXML jackson-core < 2.18.8, >= 2.19.0, < 2.21.4, >= 2.22.0, < 2.22.1
- tools.jackson.core jackson-core >= 3.0.0, < 3.1.4, >= 3.2.0, < 3.2.1
Timeline
- 2026-02-28: other: Parent advisory GHSA-72hv-8253-57qq published
- 2026-07-10: advisory: GitHub Advisory published
- 2026-07-21: disclosed: Full technical details and PoC disclosed