Cowtowncoder

**Name of the Vulnerable Software and Affected Versions** jackson-core versions 2.15.0 through 2.18.5 jackson-core versions 2.19.0 through 2.21.0 jackson-core versions 3.0.0 through 3.0.x **Description** The non-blocking (asynchronous) JSON parser in jackson-core fails to enforce the `maxNumberLength` constraint defined in `StreamReadConstraints`. This occurs because the async parsing path in `NonBlockingUtf8JsonParserBase` and related classes does not invoke number length validation methods. Specifically, methods like ` finishNumberIntegralPart()` accumulate digits into the `TextBuffer` without checks, and ` valueComplete()` fails to call `resetInt()` or `resetFloat()`, where `validateIntegerLength()` and `validateFPLength()` are executed. An attacker can submit a JSON document containing a number token of arbitrary length, leading to excessive memory allocation in the `TextBuffer` and potential `OutOfMemoryError`. Additionally, if the application calls `getBigIntegerValue()` or `getDecimalValue()`, the JVM may experience CPU exhaustion due to O(n^2) BigInteger parsing, resulting in a denial of service. **Recommendations** For jackson-core versions 2.15.0 through 2.18.5, update to a version where the `maxNumberLength` constraint is enforced in the async parser. For jackson-core versions 2.19.0 through 2.21.0, update to a version where the `maxNumberLength` constraint is enforced in the async parser. For jackson-core versions 3.0.0 through 3.0.x, update to a version where the `maxNumberLength` constraint is enforced in the async parser.

**Name of the Vulnerable Software and Affected Versions** jackson-core versions 2.15.0 through 2.18.7 jackson-core versions 2.19.0 through 2.21.3 jackson-core versions 3.0.0 through 3.1.3 **Description** A number length constraint bypass exists in the non-blocking parser. An attacker can stream JSON in small chunks without sending a terminator byte, keeping the parser in the `MINOR NUMBER INTEGER DIGITS` state indefinitely. This causes the accumulator to grow based on `maxStringLength` (default 20 MiB) instead of `maxNumberLength` (default 1000), potentially consuming up to 40 MiB of heap per connection. This can lead to JVM heap exhaustion when combined with attacker-controlled concurrency. The issue affects the integer-digit paths in the `NonBlockingUtf8JsonParserBase` class, specifically within the ` startPositiveNumber()`, ` startNegativeNumber()`, and ` finishNumberIntegralPart()` functions. Reactive frameworks that feed bytes to the async parser as they arrive, such as Spring WebFlux/Reactor, Quarkus, Helidon, and Vert.x, are particularly susceptible. Synchronous parsers and async parsers operating on complete input are not affected. **Recommendations** Update jackson-core to version 2.22.0 or later. Update jackson-core to version 3.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** FasterXML jackson-databind versions 2.4.0-rc1 through 2.12.7.1 FasterXML jackson-databind versions 2.13.x through 2.13.4.1 Bamboo Data Center and Server versions 9.1.0 through 9.2.4 Bamboo Data Center and Server versions 9.3.0 through 9.3.2 Bitbucket Data Center and Server versions 7.17.0 through 7.21.13 Bitbucket Data Center and Server versions 8.7.0 through 8.9.3 Bitbucket Data Center and Server versions 8.10.0 through 8.10.3 Bitbucket Data Center and Server versions 8.11.0 through 8.11.2 Bitbucket Data Center and Server versions 8.12.0 through 8.12.0 Bitbucket Data Center and Server versions 8.13.0 through 8.13.0 **Description** The issue is related to resource exhaustion due to a lack of a check in primitive value deserializers to avoid deep wrapper array nesting when the UNWRAP SINGLE VALUE ARRAYS feature is enabled. This can allow an unauthenticated attacker to expose assets in the environment susceptible to exploitation, with no impact to confidentiality, no impact to integrity, and high impact to availability, requiring no user interaction. **Recommendations** For FasterXML jackson-databind versions 2.4.0-rc1 through 2.12.7.1, upgrade to version 2.12.7.1 or later. For FasterXML jackson-databind versions 2.13.x through 2.13.4.1, upgrade to version 2.13.4.2 or later. For Bamboo Data Center and Server versions 9.1.0 through 9.2.4, upgrade to version 9.2.5 or later. For Bamboo Data Center and Server versions 9.3.0 through 9.3.2, upgrade to version 9.3.3 or later. For Bitbucket Data Center and Server versions 7.17.0 through 7.21.13, upgrade to version 7.21.14 or later. For Bitbucket Data Center and Server versions 8.7.0 through 8.9.3, upgrade to version 8.9.4 or later. For Bitbucket Data Center and Server versions 8.10.0 through 8.10.3, upgrade to version 8.10.4 or later. For Bitbucket Data Center and Server versions 8.11.0 through 8.11.2, upgrade to version 8.11.3 or later. For Bitbucket Data Center and Server versions 8.12.0 through 8.12.0, upgrade to version 8.12.1 or later. For Bitbucket Data Center and Server versions 8.13.0 through 8.13.0, upgrade to version 8.13.1 or later.

**Name of the Vulnerable Software and Affected Versions** com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 0 through 2.11.4 com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 2.12.0-rc1 through 2.12.1 **Description** The issue is related to the allocation of unlimited memory in the com.fasterxml.jackson.dataformat:jackson-dataformat-cbor package of the jackson-dataformats-binary library. This can be exploited by a remote attacker to cause a denial of service. The unchecked allocation of a byte buffer can cause a java.lang.OutOfMemoryError exception. **Recommendations** For com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 0 through 2.11.4, update to version 2.11.4 or later. For com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 2.12.0-rc1 through 2.12.1, update to version 2.12.1 or later. As a temporary workaround, consider restricting the allocation of byte buffers to prevent the java.lang.OutOfMemoryError exception.

**Name of the Vulnerable Software and Affected Versions** jackson-dataformat-xml versions 2.7.0 through 2.7.7 jackson-dataformat-xml versions 2.8.0 through 2.8.3 **Description** The issue allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD. This can be exploited in the XmlMapper component of the Jackson XML dataformat. **Recommendations** For jackson-dataformat-xml versions 2.7.0 through 2.7.7, update to version 2.7.8 or later. For jackson-dataformat-xml versions 2.8.0 through 2.8.3, update to version 2.8.4 or later.