Rohan-Repos

**Name of the Vulnerable Software and Affected Versions** jackson-core versions 3.0.0 through 3.0.x **Description** jackson-core contains core low-level incremental ("streaming") parser and generator abstractions. The `UTF8DataInputJsonParser` and `ReaderBasedJsonParser` bypass the `maxNestingDepth` constraint defined in `StreamReadConstraints`. This allows a user to supply a JSON document with excessive nesting, which can cause a `StackOverflowError` when the structure is processed, leading to a Denial of Service (DoS). The `maxNestingDepth` constraint has a default value of 500. The issue was addressed by adding a check that throws a `StreamConstraintsException` if the limit is reached. **Recommendations** jackson-core versions 3.0.0 through 3.0.x should be upgraded to version 3.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** jackson-core versions 2.15.0 through 2.18.5 jackson-core versions 2.19.0 through 2.21.0 jackson-core versions 3.0.0 through 3.0.x **Description** The non-blocking (asynchronous) JSON parser in jackson-core fails to enforce the `maxNumberLength` constraint defined in `StreamReadConstraints`. This occurs because the async parsing path in `NonBlockingUtf8JsonParserBase` and related classes does not invoke number length validation methods. Specifically, methods like ` finishNumberIntegralPart()` accumulate digits into the `TextBuffer` without checks, and ` valueComplete()` fails to call `resetInt()` or `resetFloat()`, where `validateIntegerLength()` and `validateFPLength()` are executed. An attacker can submit a JSON document containing a number token of arbitrary length, leading to excessive memory allocation in the `TextBuffer` and potential `OutOfMemoryError`. Additionally, if the application calls `getBigIntegerValue()` or `getDecimalValue()`, the JVM may experience CPU exhaustion due to O(n^2) BigInteger parsing, resulting in a denial of service. **Recommendations** For jackson-core versions 2.15.0 through 2.18.5, update to a version where the `maxNumberLength` constraint is enforced in the async parser. For jackson-core versions 2.19.0 through 2.21.0, update to a version where the `maxNumberLength` constraint is enforced in the async parser. For jackson-core versions 3.0.0 through 3.0.x, update to a version where the `maxNumberLength` constraint is enforced in the async parser.