CVE-2026-68498

Name of the Vulnerable Software and Affected Versions jackson-core versions 2.16.0 through 2.18.0 jackson-core versions 3.0.0 through 3.0.0

Description Parsers built over character input, such as Reader, String, or char[] sources served by ReaderBasedJsonParser, fail to properly apply the maxNameLength constraint during the accumulation of JSON Object property names. Instead of the intended 50,000-character limit, the system uses the maxStringLength check, which allows up to 100,000,000 characters. This occurs because the parseName2() function accumulates the name into the TextBuffer and only validates maxStringLength when a segment fills, delaying the validateNameLength(int) check until the entire name has been buffered. A remote attacker can exploit this by providing a sufficiently long property name, forcing memory allocations of approximately 200 MB per request, which can lead to heap exhaustion and process crashes. This issue is exploitable under default configurations as maxDocumentLength is disabled by default. Byte-input parsers are not affected.

Recommendations Update jackson-core to version 2.18.1 or later. Update jackson-core to a version later than 3.0.0. As a temporary mitigation, avoid parsing untrusted JSON from String, Reader, or char[] sources and use raw UTF-8 bytes instead.