Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 8.7, published 4 August 2026.

Which products and versions are affected?

FasterXML Jackson-Core 2.15.0 through 2.18.5, 2.19.0 through 2.21.0.

Is there a fix for This vulnerability?

A patch was published on 2026-02-22: Fix committed (b0c428e); patches released in 2.18.6, 2.21.1, 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run FasterXML Jackson-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

FasterXML jackson-core number length constraint bypass in async parser

Severity: medium · CVSS 8.7 · Published 2026-08-04

Jackson-core is a widely-used JSON parsing library. The async JSON parser component bypasses the number length limit (default 1,000 characters) that is correctly enforced in the synchronous parser. An attacker can send JSON containing extremely large numbers to applications using the async parser (such as Spring WebFlux reactive applications), causing the application to consume excessive memory and CPU, leading to service outage or application crash.

Technologies: FasterXML Jackson-Core. Vendors: FasterXML.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 8.7, published 4 August 2026.
Which products and versions are affected?: FasterXML Jackson-Core 2.15.0 through 2.18.5, 2.19.0 through 2.21.0.
Is there a fix for This vulnerability?: A patch was published on 2026-02-22: Fix committed (b0c428e); patches released in 2.18.6, 2.21.1, 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run FasterXML Jackson-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a constraint validation bypass in the non-blocking parser path of jackson-core. The async parsing methods in NonBlockingUtf8JsonParserBase accumulate number digits into a TextBuffer without length checks, then call _valueComplete() to finalize the token. Unlike the synchronous parser, _valueComplete() does not invoke resetInt() or resetFloat()—the methods in ParserBase where validateIntegerLength() and validateFPLength() perform the maxNumberLength validation. As a result, the StreamReadConstraints.maxNumberLength constraint is never enforced for async parsing. Exploitation requires only the ability to submit JSON data; no privileges or user interaction is required. Impact includes unbounded memory allocation leading to OutOfMemoryError, and if getBigIntegerValue() or getDecimalValue() are called, O(n²) BigInteger parsing ties up the JVM, causing CPU-based denial of service. Patches are available in 2.18.6, 2.21.1, and 3.1.0.

Affected products

FasterXML jackson-core 2.15.0 through 2.18.5, 2.19.0 through 2.21.0
FasterXML jackson-core 3.0.0 through 3.0.4

Timeline

2026-02-26: disclosed: Original advisory GHSA-72hv-8253-57qq published
2026-02-22: patched: Fix committed (b0c428e); patches released in 2.18.6, 2.21.1, 3.1.0
2026-08-04: advisory: Duplicate advisory GHSA-6qm2-mcq7-53qp published (withdrawn 2026-09-01)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.