CVE-2026-18401

Name of the Vulnerable Software and Affected Versions jackson-core versions 2.15.0 through 2.18.5 jackson-core versions 2.19.0 through 2.21.0 jackson-core versions 3.0.0 through 3.0.x

Description The non-blocking (asynchronous) JSON parser in jackson-core fails to enforce the maxNumberLength constraint defined in StreamReadConstraints. This occurs because the async parsing path in NonBlockingUtf8JsonParserBase and related classes does not invoke number length validation methods. Specifically, methods like finishNumberIntegralPart() accumulate digits into the TextBuffer without checks, and valueComplete() fails to call resetInt() or resetFloat(), where validateIntegerLength() and validateFPLength() are executed. An attacker can submit a JSON document containing a number token of arbitrary length, leading to excessive memory allocation in the TextBuffer and potential OutOfMemoryError. Additionally, if the application calls getBigIntegerValue() or getDecimalValue(), the JVM may experience CPU exhaustion due to O(n^2) BigInteger parsing, resulting in a denial of service.

Recommendations For jackson-core versions 2.15.0 through 2.18.5, update to a version where the maxNumberLength constraint is enforced in the async parser. For jackson-core versions 2.19.0 through 2.21.0, update to a version where the maxNumberLength constraint is enforced in the async parser. For jackson-core versions 3.0.0 through 3.0.x, update to a version where the maxNumberLength constraint is enforced in the async parser.