CVE-2026-68494

Name of the Vulnerable Software and Affected Versions jackson-core versions 2.15.0 through 2.18.7 jackson-core versions 2.19.0 through 2.21.3 jackson-core versions 3.0.0 through 3.1.3

Description A number length constraint bypass exists in the non-blocking parser. An attacker can stream JSON in small chunks without sending a terminator byte, keeping the parser in the MINOR NUMBER INTEGER DIGITS state indefinitely. This causes the accumulator to grow based on maxStringLength (default 20 MiB) instead of maxNumberLength (default 1000), potentially consuming up to 40 MiB of heap per connection. This can lead to JVM heap exhaustion when combined with attacker-controlled concurrency.

The issue affects the integer-digit paths in the NonBlockingUtf8JsonParserBase class, specifically within the startPositiveNumber(), startNegativeNumber(), and finishNumberIntegralPart() functions. Reactive frameworks that feed bytes to the async parser as they arrive, such as Spring WebFlux/Reactor, Quarkus, Helidon, and Vert.x, are particularly susceptible. Synchronous parsers and async parsers operating on complete input are not affected.

Recommendations Update jackson-core to version 2.22.0 or later. Update jackson-core to version 3.2.0 or later.