# FasterXML jackson-core number length constraint bypass in async parser

Source: https://junglewise.ai/threats/fasterxml-jackson-core-number-length-constraint-bypass-in-async-parser-78aa3f75  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 8.7 · Published 2026-08-04

Jackson-core is a widely-used JSON parsing library. The async JSON parser component bypasses the number length limit (default 1,000 characters) that is correctly enforced in the synchronous parser. An attacker can send JSON containing extremely large numbers to applications using the async parser (such as Spring WebFlux reactive applications), causing the application to consume excessive memory and CPU, leading to service outage or application crash.

Technologies: [FasterXML Jackson-Core](https://junglewise.ai/threats/technologies/jackson-core). Vendors: [FasterXML](https://junglewise.ai/threats/vendors/fasterxml).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 8.7, published 4 August 2026.

**Which products and versions are affected?** FasterXML Jackson-Core 2.15.0 through 2.18.5, 2.19.0 through 2.21.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-02-22: Fix committed (b0c428e); patches released in 2.18.6, 2.21.1, 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run FasterXML Jackson-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a constraint validation bypass in the non-blocking parser path of jackson-core. The async parsing methods in NonBlockingUtf8JsonParserBase accumulate number digits into a TextBuffer without length checks, then call _valueComplete() to finalize the token. Unlike the synchronous parser, _valueComplete() does not invoke resetInt() or resetFloat()—the methods in ParserBase where validateIntegerLength() and validateFPLength() perform the maxNumberLength validation. As a result, the StreamReadConstraints.maxNumberLength constraint is never enforced for async parsing. Exploitation requires only the ability to submit JSON data; no privileges or user interaction is required. Impact includes unbounded memory allocation leading to OutOfMemoryError, and if getBigIntegerValue() or getDecimalValue() are called, O(n²) BigInteger parsing ties up the JVM, causing CPU-based denial of service. Patches are available in 2.18.6, 2.21.1, and 3.1.0.

## Affected products

- FasterXML jackson-core 2.15.0 through 2.18.5, 2.19.0 through 2.21.0
- FasterXML jackson-core 3.0.0 through 3.0.4

## Timeline

- 2026-02-26: disclosed: Original advisory GHSA-72hv-8253-57qq published
- 2026-02-22: patched: Fix committed (b0c428e); patches released in 2.18.6, 2.21.1, 3.1.0
- 2026-08-04: advisory: Duplicate advisory GHSA-6qm2-mcq7-53qp published (withdrawn 2026-09-01)

## References

- [https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq)
- [https://github.com/FasterXML/jackson-core/pull/1555](https://github.com/FasterXML/jackson-core/pull/1555)
- [https://github.com/FasterXML/jackson-core/commit/b0c428e6f993e1b5ece5c1c3cb2523e887cd52cf](https://github.com/FasterXML/jackson-core/commit/b0c428e6f993e1b5ece5c1c3cb2523e887cd52cf)

## Related threats

- [Jackson Core denial of service via unbounded JSON property name allocation](https://junglewise.ai/threats/cve-2026-68498-streamreadconstraints-maxnamelength-default-50-000-characters-is)
- [FasterXML jackson-core denial of service in UTF8DataInputJsonParser](https://junglewise.ai/threats/cve-2026-89425-utf8datainputjsonparser-reportinvalidtoken-in-fasterxml-jackson)
- [FasterXML jackson-core regular expression denial of service in NumberInput](https://junglewise.ai/threats/cve-2026-89407-numberinput-lookslikevalidnumber-in-fasterxml-jackson-core-pre)
- [FasterXML jackson-core incomplete number length validation bypass](https://junglewise.ai/threats/cve-2026-68494-fasterxml-jackson-core-incomplete-number-length-validation-bypass)
- [FasterXML jackson-core memory exhaustion in async parser via chunked digits](https://junglewise.ai/threats/fasterxml-jackson-core-memory-exhaustion-in-async-parser-via-chunked-aac0fe2a)