Executive brief
Jackson-core is a widely-used JSON parsing library. The async JSON parser component bypasses the number length limit (default 1,000 characters) that is correctly enforced in the synchronous parser. An attacker can send JSON containing extremely large numbers to applications using the async parser (such as Spring WebFlux reactive applications), causing the application to consume excessive memory and CPU, leading to service outage or application crash.
Technical details
The vulnerability is a constraint validation bypass in the non-blocking parser path of jackson-core. The async parsing methods in NonBlockingUtf8JsonParserBase accumulate number digits into a TextBuffer without length checks, then call _valueComplete() to finalize the token. Unlike the synchronous parser, _valueComplete() does not invoke resetInt() or resetFloat()—the methods in ParserBase where validateIntegerLength() and validateFPLength() perform the maxNumberLength validation. As a result, the StreamReadConstraints.maxNumberLength constraint is never enforced for async parsing. Exploitation requires only the ability to submit JSON data; no privileges or user interaction is required. Impact includes unbounded memory allocation leading to OutOfMemoryError, and if getBigIntegerValue() or getDecimalValue() are called, O(n²) BigInteger parsing ties up the JVM, causing CPU-based denial of service. Patches are available in 2.18.6, 2.21.1, and 3.1.0.
Affected products
- FasterXML jackson-core 2.15.0 through 2.18.5, 2.19.0 through 2.21.0
- FasterXML jackson-core 3.0.0 through 3.0.4
Timeline
- 2026-02-26: disclosed: Original advisory GHSA-72hv-8253-57qq published
- 2026-02-22: patched: Fix committed (b0c428e); patches released in 2.18.6, 2.21.1, 3.1.0
- 2026-08-04: advisory: Duplicate advisory GHSA-6qm2-mcq7-53qp published (withdrawn 2026-09-01)