{"id":"CVE-2026-18401","aliases":["CLSA-2026-1776386157","CLSA-2026-1789484097","CLSA-2026-1791447404","CLSA-2026-1791485698","CLSA-2026-1791493683","CLSA-2026-1791495450","CLSA-2026-1792399384","CLSA-2026-1792399460","CLSA-2026-1792399472","CLSA-2026-1792428564","CLSA-2026-1792431620","CLSA-2026-1792431627","CLSA-2026-1792434304","CLSA-2026-1793085045","CLSA-2026-1793085177","CLSA-2026-1793196863","DEBIAN-CVE-2026-18401","EUVD-2026-52699","GHSA-6qm2-mcq7-53qp","GHSA-72hv-8253-57qq","GHSA-r7wm-3cxj-wff9","ROOT-APP-MAVEN-CVE-2026-18401","ROOT-APP-MAVEN-GHSA-72hv-8253-57qq","SUSE-SU-2026:24149-1","SUSE-SU-2026:4394-1","UBUNTU-CVE-2026-18401","openSUSE-SU-2026:11638-1","openSUSE-SU-2026:22034-1","sonatype-2022-6438"],"status":"published","title":"jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service","description":"The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service.\n\n\n\nThe synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on which parsing API the application uses.\n\n\n\nRoot cause: the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods. Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never enforced on the async code path.\n\n\n\nImpact: an attacker sending a JSON document containing an arbitrarily long number to an application using the async parser (for example a Spring WebFlux or other reactive application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in O(n^2) BigInteger parsing, causing CPU-based denial of service.\n\n\n\nNo privileges or user interaction beyond the ability to submit data for parsing are required.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x.\n\n\n\nVersions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00408,"percentile":0.35412,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-02-28T02:01:05Z","modified":"2026-11-05T09:15:09Z","fixes":[{"ecosystem":"Maven","package":"tools.jackson.core:jackson-core","fixed_in":["3.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","fixed_in":["2.21.1","2.18.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","fixed_in":["2.17.3-tuxcare.1","2.18.5-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-core","fixed_in":["3.1.0-aikido.2","3.1.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-core","fixed_in":["2.21.1-aikido.1","2.13.3-aikido.2","2.15.3-aikido.2","2.16.1-aikido.2","2.16.2-aikido.2","2.18.2-aikido.2","2.20.0-aikido.2","2.18.3-aikido.2","2.17.2-aikido.1","2.14.1-aikido.1","2.14.1-aikido.2","2.17.1-aikido.1","2.15.2-aikido.1","2.14.3-aikido.2","2.13.2-aikido.3","2.19.4-aikido.1","2.12.4-aikido.2","2.12.5-aikido.2","2.10.1-aikido.2","2.12.3-aikido.2","2.13.4-aikido.2","2.14.2-aikido.2","2.17.0-aikido.1","2.14.2-aikido.3","2.15.2-aikido.2","2.14.3-aikido.3","2.12.3-aikido.3","2.12.4-aikido.3","2.13.2-aikido.4","2.12.5-aikido.3","2.13.4-aikido.3","2.14.1-aikido.3","2.10.1-aikido.3","2.17.2-aikido.2","2.19.4-aikido.2","2.17.0-aikido.2","2.17.1-aikido.2","2.15.3-aikido.3","2.15.0-aikido.1","2.17.2-aikido.3","2.17.2-aikido.4","2.14.2-aikido.4","2.15.2-aikido.3","2.17.1-aikido.3","2.19.0-aikido.1","2.17.2-aikido.5","2.18.3-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-core","fixed_in":["3.1.0-root.io.1","3.1.0-root.io.2","3.1.0-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-core","fixed_in":["2.21.1-root.io.1","2.18.2-root.io.1","2.16.2-root.io.1","2.16.1-root.io.1","2.18.3-root.io.1","2.13.3-root.io.1","2.20.0-root.io.1","2.15.3-root.io.1","2.13.3-root.io.2","2.15.3-root.io.2","2.16.1-root.io.2","2.16.2-root.io.2","2.18.2-root.io.2","2.20.0-root.io.2","2.18.3-root.io.2","2.17.2-root.io.1","2.14.1-root.io.1","2.14.1-root.io.2","2.17.1-root.io.1","2.15.2-root.io.1","2.14.3-root.io.2","2.13.2-root.io.3","2.19.4-root.io.1","2.12.4-root.io.2","2.12.5-root.io.2","2.14.2-root.io.2","2.10.1-root.io.2","2.12.3-root.io.2","2.13.4-root.io.2","2.17.0-root.io.1","2.14.2-root.io.3","2.15.2-root.io.2","2.14.3-root.io.3","2.12.3-root.io.3","2.12.4-root.io.3","2.13.2-root.io.4","2.12.5-root.io.3","2.13.4-root.io.3","2.14.1-root.io.3","2.10.1-root.io.3","2.17.2-root.io.2","2.19.4-root.io.2","2.17.0-root.io.2","2.17.1-root.io.2","2.15.3-root.io.3","2.15.0-root.io.1","2.17.2-root.io.3","2.17.2-root.io.4","2.14.2-root.io.4","2.15.2-root.io.3","2.17.1-root.io.3","2.19.0-root.io.1","2.17.2-root.io.5","2.18.3-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.21.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.0"},{"last_affected":"2.18.5"},{"fixed":"2.18.6"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.1"}]}],"versions":["2.12.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.2"},{"fixed":"2.17.2-tuxcare.1"}]}],"versions":["2.17.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.3"},{"fixed":"2.17.3-tuxcare.1"}]}],"versions":["2.17.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.1"},{"fixed":"2.17.1-tuxcare.1"}]}],"versions":["2.17.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.2"},{"fixed":"2.14.2-tuxcare.3"}]}],"versions":["2.14.2","2.14.2-tuxcare.1","2.14.2-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.1"},{"fixed":"2.14.1-tuxcare.2"}]}],"versions":["2.14.1","2.14.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.4"},{"fixed":"2.15.4-tuxcare.1"}]}],"versions":["2.15.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.2"},{"fixed":"2.13.2-tuxcare.1"}]}],"versions":["2.13.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.4"},{"fixed":"2.13.4-tuxcare.1"}]}],"versions":["2.13.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.5"},{"fixed":"2.18.5-tuxcare.1"}]}],"versions":["2.18.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.1"},{"fixed":"2.16.1-tuxcare.1"}]}],"versions":["2.16.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.0"},{"fixed":"2.15.0-tuxcare.1"}]}],"versions":["2.15.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.3"},{"fixed":"2.13.3-tuxcare.1"}]}],"versions":["2.13.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.4.1"},{"fixed":"2.18.4.1-tuxcare.2"}]}],"versions":["2.18.4.1","2.18.4.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.1"},{"fixed":"2.20.1-tuxcare.1"}]}],"versions":["2.20.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.4"},{"fixed":"2.19.4-tuxcare.1"}]}],"versions":["2.19.4"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.0"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0-rc1"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.21.1"}]}],"versions":["2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.0-rc1","2.20.1","2.20.2","2.21.0"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.0"},{"fixed":"2.18.6"}]}],"versions":["2.15.0","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0-rc1","2.16.1","2.16.2","2.17.0","2.17.0-rc1","2.17.1","2.17.2","2.17.3","2.18.0","2.18.0-rc1","2.18.1","2.18.2","2.18.3","2.18.4","2.18.4.1","2.18.5"]},{"source":"osv","ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-aikido.2"},{"fixed":"3.1.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-root.io.1"},{"fixed":"3.1.0-root.io.2"},{"fixed":"3.1.0-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.1-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.3-aikido.2"},{"fixed":"2.15.3-aikido.2"},{"fixed":"2.16.1-aikido.2"},{"fixed":"2.16.2-aikido.2"},{"fixed":"2.18.2-aikido.2"},{"fixed":"2.20.0-aikido.2"},{"fixed":"2.18.3-aikido.2"},{"fixed":"2.17.2-aikido.1"},{"fixed":"2.14.1-aikido.1"},{"fixed":"2.14.1-aikido.2"},{"fixed":"2.17.1-aikido.1"},{"fixed":"2.15.2-aikido.1"},{"fixed":"2.14.3-aikido.2"},{"fixed":"2.13.2-aikido.3"},{"fixed":"2.19.4-aikido.1"},{"fixed":"2.12.4-aikido.2"},{"fixed":"2.12.5-aikido.2"},{"fixed":"2.10.1-aikido.2"},{"fixed":"2.12.3-aikido.2"},{"fixed":"2.13.4-aikido.2"},{"fixed":"2.14.2-aikido.2"},{"fixed":"2.17.0-aikido.1"},{"fixed":"2.14.2-aikido.3"},{"fixed":"2.15.2-aikido.2"},{"fixed":"2.14.3-aikido.3"},{"fixed":"2.12.3-aikido.3"},{"fixed":"2.12.4-aikido.3"},{"fixed":"2.13.2-aikido.4"},{"fixed":"2.12.5-aikido.3"},{"fixed":"2.13.4-aikido.3"},{"fixed":"2.14.1-aikido.3"},{"fixed":"2.10.1-aikido.3"},{"fixed":"2.17.2-aikido.2"},{"fixed":"2.19.4-aikido.2"},{"fixed":"2.17.0-aikido.2"},{"fixed":"2.17.1-aikido.2"},{"fixed":"2.15.3-aikido.3"},{"fixed":"2.15.0-aikido.1"},{"fixed":"2.17.2-aikido.3"},{"fixed":"2.17.2-aikido.4"},{"fixed":"2.14.2-aikido.4"},{"fixed":"2.15.2-aikido.3"},{"fixed":"2.17.1-aikido.3"},{"fixed":"2.19.0-aikido.1"},{"fixed":"2.17.2-aikido.5"},{"fixed":"2.18.3-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.2-root.io.1"},{"fixed":"2.16.2-root.io.1"},{"fixed":"2.16.1-root.io.1"},{"fixed":"2.18.3-root.io.1"},{"fixed":"2.13.3-root.io.1"},{"fixed":"2.20.0-root.io.1"},{"fixed":"2.15.3-root.io.1"},{"fixed":"2.13.3-root.io.2"},{"fixed":"2.15.3-root.io.2"},{"fixed":"2.16.1-root.io.2"},{"fixed":"2.16.2-root.io.2"},{"fixed":"2.18.2-root.io.2"},{"fixed":"2.20.0-root.io.2"},{"fixed":"2.18.3-root.io.2"},{"fixed":"2.17.2-root.io.1"},{"fixed":"2.14.1-root.io.1"},{"fixed":"2.14.1-root.io.2"},{"fixed":"2.17.1-root.io.1"},{"fixed":"2.15.2-root.io.1"},{"fixed":"2.14.3-root.io.2"},{"fixed":"2.13.2-root.io.3"},{"fixed":"2.19.4-root.io.1"},{"fixed":"2.12.4-root.io.2"},{"fixed":"2.12.5-root.io.2"},{"fixed":"2.14.2-root.io.2"},{"fixed":"2.10.1-root.io.2"},{"fixed":"2.12.3-root.io.2"},{"fixed":"2.13.4-root.io.2"},{"fixed":"2.17.0-root.io.1"},{"fixed":"2.14.2-root.io.3"},{"fixed":"2.15.2-root.io.2"},{"fixed":"2.14.3-root.io.3"},{"fixed":"2.12.3-root.io.3"},{"fixed":"2.12.4-root.io.3"},{"fixed":"2.13.2-root.io.4"},{"fixed":"2.12.5-root.io.3"},{"fixed":"2.13.4-root.io.3"},{"fixed":"2.14.1-root.io.3"},{"fixed":"2.10.1-root.io.3"},{"fixed":"2.17.2-root.io.2"},{"fixed":"2.19.4-root.io.2"},{"fixed":"2.17.0-root.io.2"},{"fixed":"2.17.1-root.io.2"},{"fixed":"2.15.3-root.io.3"},{"fixed":"2.15.0-root.io.1"},{"fixed":"2.17.2-root.io.3"},{"fixed":"2.17.2-root.io.4"},{"fixed":"2.14.2-root.io.4"},{"fixed":"2.15.2-root.io.3"},{"fixed":"2.17.1-root.io.3"},{"fixed":"2.19.0-root.io.1"},{"fixed":"2.17.2-root.io.5"},{"fixed":"2.18.3-root.io.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.6-1","2.9.1-1","2.9.4-1","2.9.8-3~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.8-3","2.10.0-1","2.10.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-1","2.13.0-1","2.13.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1build1","2.14.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1","2.14.1-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10}],"products":[{"vendor":"fasterxml","product":"jackson-core"}],"references":[{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq","tags":["vendor-advisory","exploit","advisory","web","report"]},{"url":"https://github.com/FasterXML/jackson-core/pull/1555","tags":["patch","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-core/commit/b0c428e6f993e1b5ece5c1c3cb2523e887cd52cf","tags":["patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18401","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6qm2-mcq7-53qp"},{"url":"https://github.com/advisories/GHSA-72hv-8253-57qq"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18401.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-core","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-18401","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624149-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273856","tags":["report"]},{"url":"https://bugzilla.suse.com/1273857","tags":["report"]},{"url":"https://bugzilla.suse.com/1277883","tags":["report"]},{"url":"https://bugzilla.suse.com/1278008","tags":["report"]},{"url":"https://bugzilla.suse.com/1280125","tags":["report"]},{"url":"https://bugzilla.suse.com/1282491","tags":["report"]},{"url":"https://bugzilla.suse.com/1282492","tags":["report"]},{"url":"https://bugzilla.suse.com/1282505","tags":["report"]},{"url":"https://bugzilla.suse.com/1282641","tags":["report"]},{"url":"https://bugzilla.suse.com/1282645","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-83557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91777","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264394-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282639","tags":["report"]},{"url":"https://bugzilla.suse.com/1282640","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68496","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-18401","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18401","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-18401","title":"jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service","description":"The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service.\n\n\n\nThe synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on which parsing API the application uses.\n\n\n\nRoot cause: the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods. Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never enforced on the async code path.\n\n\n\nImpact: an attacker sending a JSON document containing an arbitrarily long number to an application using the async parser (for example a Spring WebFlux or other reactive application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in O(n^2) BigInteger parsing, causing CPU-based denial of service.\n\n\n\nNo privileges or user interaction beyond the ability to submit data for parsing are required.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x.\n\n\n\nVersions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0.","status":"published","published":"2026-08-04T14:23:27.174Z","modified":"2026-08-04T17:59:07.408Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:20:12.60856Z"}],"euvd":[{"id":"EUVD-2026-52699","description":"The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service.\n\n\n\nThe synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on which parsing API the application uses.\n\n\n\nRoot cause: the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods. Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never enforced on the async code path.\n\n\n\nImpact: an attacker sending a JSON document containing an arbitrarily long number to an application using the async parser (for example a Spring WebFlux or other reactive application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in O(n^2) BigInteger parsing, causing CPU-based denial of service.\n\n\n\nNo privileges or user interaction beyond the ability to submit data for parsing are required.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x.\n\n\n\nVersions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0.","status":"published","published":"2026-08-04T14:23:27Z","modified":"2026-08-04T17:59:07Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:22.516769Z"}],"ghsa":[{"id":"GHSA-6qm2-mcq7-53qp","title":"Duplicate Advisory: jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-72hv-8253-57qq. This link is maintained to preserve external references.\n\n## Original Description\n\nThe non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service.\n\n\n\nThe synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on which parsing API the application uses.\n\n\n\nRoot cause: the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods. Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never enforced on the async code path.\n\n\n\nImpact: an attacker sending a JSON document containing an arbitrarily long number to an application using the async parser (for example a Spring WebFlux or other reactive application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in O(n^2) BigInteger parsing, causing CPU-based denial of service.\n\n\n\nNo privileges or user interaction beyond the ability to submit data for parsing are required.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x.\n\n\n\nVersions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0.","status":"withdrawn","published":"2026-08-04T15:32:23Z","modified":"2026-09-01T18:56:40Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:08.980668Z"},{"id":"GHSA-72hv-8253-57qq","title":"jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition","description":"### Summary\nThe non-blocking (async) JSON parser in `jackson-core` bypasses the `maxNumberLength` constraint (default: 1000 characters) defined in `StreamReadConstraints`. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS).\n\nThe standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy.\n\n### Details\nThe root cause is that the async parsing path in `NonBlockingUtf8JsonParserBase` (and related classes) does not call the methods responsible for number length validation.\n\n- The number parsing methods (e.g., `_finishNumberIntegralPart`) accumulate digits into the `TextBuffer` without any length checks.\n- After parsing, they call `_valueComplete()`, which finalizes the token but does **not** call `resetInt()` or `resetFloat()`.\n- The `resetInt()`/`resetFloat()` methods in `ParserBase` are where the `validateIntegerLength()` and `validateFPLength()` checks are performed.\n- Because this validation step is skipped, the `maxNumberLength` constraint is never enforced in the async code path.\n\n### PoC\nThe following JUnit 5 test demonstrates the vulnerability. It shows that the async parser accepts a 5,000-digit number, whereas the limit should be 1,000.\n\n```java\npackage tools.jackson.core.unittest.dos;\n\nimport java.nio.charset.StandardCharsets;\n\nimport org.junit.jupiter.api.Test;\n\nimport tools.jackson.core.*;\nimport tools.jackson.core.exc.StreamConstraintsException;\nimport tools.jackson.core.json.JsonFactory;\nimport tools.jackson.core.json.async.NonBlockingByteArrayJsonParser;\n\nimport static org.junit.jupiter.api.Assertions.*;\n\n/**\n * POC: Number Length Constraint Bypass in Non-Blocking (Async) JSON Parsers\n *\n * Authors: sprabhav7, rohan-repos\n * \n * maxNumberLength default = 1000 characters (digits).\n * A number with more than 1000 digits should be rejected by any parser.\n *\n * BUG: The async parser never calls resetInt()/resetFloat() which is where\n * validateIntegerLength()/validateFPLength() lives. Instead it calls\n * _valueComplete() which skips all number length validation.\n *\n * CWE-770: Allocation of Resources Without Limits or Throttling\n */\nclass AsyncParserNumberLengthBypassTest {\n\n private static final int MAX_NUMBER_LENGTH = 1000;\n private static final int TEST_NUMBER_LENGTH = 5000;\n\n private final JsonFactory factory = new JsonFactory();\n\n // CONTROL: Sync parser correctly rejects a number exceeding maxNumberLength\n @Test\n void syncParserRejectsLongNumber() throws Exception {\n byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);\n\t\t\n\t\t// Output to console\n System.out.println(\"[SYNC] Parsing \" + TEST_NUMBER_LENGTH + \"-digit number (limit: \" + MAX_NUMBER_LENGTH + \")\");\n try {\n try (JsonParser p = factory.createParser(ObjectReadContext.empty(), payload)) {\n while (p.nextToken() != null) {\n if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {\n System.out.println(\"[SYNC] Accepted number with \" + p.getText().length() + \" digits — UNEXPECTED\");\n }\n }\n }\n fail(\"Sync parser must reject a \" + TEST_NUMBER_LENGTH + \"-digit number\");\n } catch (StreamConstraintsException e) {\n System.out.println(\"[SYNC] Rejected with StreamConstraintsException: \" + e.getMessage());\n }\n }\n\n // VULNERABILITY: Async parser accepts the SAME number that sync rejects\n @Test\n void asyncParserAcceptsLongNumber() throws Exception {\n byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);\n\n NonBlockingByteArrayJsonParser p =\n (NonBlockingByteArrayJsonParser) factory.createNonBlockingByteArrayParser(ObjectReadContext.empty());\n p.feedInput(payload, 0, payload.length);\n p.endOfInput();\n\n boolean foundNumber = false;\n try {\n while (p.nextToken() != null) {\n if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {\n foundNumber = true;\n String numberText = p.getText();\n assertEquals(TEST_NUMBER_LENGTH, numberText.length(),\n \"Async parser silently accepted all \" + TEST_NUMBER_LENGTH + \" digits\");\n }\n }\n // Output to console\n System.out.println(\"[ASYNC INT] Accepted number with \" + TEST_NUMBER_LENGTH + \" digits — BUG CONFIRMED\");\n assertTrue(foundNumber, \"Parser should have produced a VALUE_NUMBER_INT token\");\n } catch (StreamConstraintsException e) {\n fail(\"Bug is fixed — async parser now correctly rejects long numbers: \" + e.getMessage());\n }\n p.close();\n }\n\n private byte[] buildPayloadWithLongInteger(int numDigits) {\n StringBuilder sb = new StringBuilder(numDigits + 10);\n sb.append(\"{\\\"v\\\":\");\n for (int i = 0; i \u003c numDigits; i++) {\n sb.append((char) ('1' + (i % 9)));\n }\n sb.append('}');\n return sb.toString().getBytes(StandardCharsets.UTF_8);\n }\n}\n\n```\n\n\n### Impact\nA malicious actor can send a JSON document with an arbitrarily long number to an application using the async parser (e.g., in a Spring WebFlux or other reactive application). This can cause:\n1. **Memory Exhaustion:** Unbounded allocation of memory in the `TextBuffer` to store the number's digits, leading to an `OutOfMemoryError`.\n2. **CPU Exhaustion:** If the application subsequently calls `getBigIntegerValue()` or `getDecimalValue()`, the JVM can be tied up in O(n^2) `BigInteger` parsing operations, leading to a CPU-based DoS.\n\n### Suggested Remediation\n\nThe async parsing path should be updated to respect the `maxNumberLength` constraint. The simplest fix appears to ensure that `_valueComplete()` or a similar method in the async path calls the appropriate validation methods (`resetInt()` or `resetFloat()`) already present in `ParserBase`, mirroring the behavior of the synchronous parsers.\n\n**NOTE:** This research was performed in collaboration with [rohan-repos](https://github.com/rohan-repos)","status":"published","published":"2026-02-28T02:01:05Z","modified":"2026-09-01T18:57:19Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:08.980668Z"}],"nvd":[{"id":"CVE-2026-18401","description":"The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service.\n\n\n\nThe synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on which parsing API the application uses.\n\n\n\nRoot cause: the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods. Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never enforced on the async code path.\n\n\n\nImpact: an attacker sending a JSON document containing an arbitrarily long number to an application using the async parser (for example a Spring WebFlux or other reactive application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in O(n^2) BigInteger parsing, causing CPU-based denial of service.\n\n\n\nNo privileges or user interaction beyond the ability to submit data for parsing are required.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x.\n\n\n\nVersions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0.","status":"published","published":"2026-08-04T15:16:29.9Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:34.643497Z"}],"osv":[{"id":"CVE-2026-18401","title":"jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service","description":"The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service.\n\n\n\nThe synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on which parsing API the application uses.\n\n\n\nRoot cause: the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods. Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never enforced on the async code path.\n\n\n\nImpact: an attacker sending a JSON document containing an arbitrarily long number to an application using the async parser (for example a Spring WebFlux or other reactive application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in O(n^2) BigInteger parsing, causing CPU-based denial of service.\n\n\n\nNo privileges or user interaction beyond the ability to submit data for parsing are required.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x.\n\n\n\nVersions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0.","status":"published","published":"2026-08-04T14:23:27.174Z","modified":"2026-10-28T11:07:50.131070853Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:58.024074Z"},{"id":"DEBIAN-CVE-2026-18401","description":"The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service. The synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on which parsing API the application uses. Root cause: the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods. Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never enforced on the async code path. Impact: an attacker sending a JSON document containing an arbitrarily long number to an application using the async parser (for example a Spring WebFlux or other reactive application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in O(n^2) BigInteger parsing, causing CPU-based denial of service. No privileges or user interaction beyond the ability to submit data for parsing are required. This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0.","status":"withdrawn","published":"2026-08-04T15:16:29.9Z","modified":"2026-08-07T08:00:39.685035005Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"GHSA-6qm2-mcq7-53qp","title":"Duplicate Advisory: jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-72hv-8253-57qq. This link is maintained to preserve external references.\n\n## Original Description\n\nThe non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service.\n\n\n\nThe synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on which parsing API the application uses.\n\n\n\nRoot cause: the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods. Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never enforced on the async code path.\n\n\n\nImpact: an attacker sending a JSON document containing an arbitrarily long number to an application using the async parser (for example a Spring WebFlux or other reactive application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in O(n^2) BigInteger parsing, causing CPU-based denial of service.\n\n\n\nNo privileges or user interaction beyond the ability to submit data for parsing are required.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x.\n\n\n\nVersions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0.","status":"withdrawn","published":"2026-08-04T15:32:23Z","modified":"2026-09-10T03:51:13.304855317Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"GHSA-72hv-8253-57qq","title":"jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition","description":"### Summary\nThe non-blocking (async) JSON parser in `jackson-core` bypasses the `maxNumberLength` constraint (default: 1000 characters) defined in `StreamReadConstraints`. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS).\n\nThe standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy.\n\n### Details\nThe root cause is that the async parsing path in `NonBlockingUtf8JsonParserBase` (and related classes) does not call the methods responsible for number length validation.\n\n- The number parsing methods (e.g., `_finishNumberIntegralPart`) accumulate digits into the `TextBuffer` without any length checks.\n- After parsing, they call `_valueComplete()`, which finalizes the token but does **not** call `resetInt()` or `resetFloat()`.\n- The `resetInt()`/`resetFloat()` methods in `ParserBase` are where the `validateIntegerLength()` and `validateFPLength()` checks are performed.\n- Because this validation step is skipped, the `maxNumberLength` constraint is never enforced in the async code path.\n\n### PoC\nThe following JUnit 5 test demonstrates the vulnerability. It shows that the async parser accepts a 5,000-digit number, whereas the limit should be 1,000.\n\n```java\npackage tools.jackson.core.unittest.dos;\n\nimport java.nio.charset.StandardCharsets;\n\nimport org.junit.jupiter.api.Test;\n\nimport tools.jackson.core.*;\nimport tools.jackson.core.exc.StreamConstraintsException;\nimport tools.jackson.core.json.JsonFactory;\nimport tools.jackson.core.json.async.NonBlockingByteArrayJsonParser;\n\nimport static org.junit.jupiter.api.Assertions.*;\n\n/**\n * POC: Number Length Constraint Bypass in Non-Blocking (Async) JSON Parsers\n *\n * Authors: sprabhav7, rohan-repos\n * \n * maxNumberLength default = 1000 characters (digits).\n * A number with more than 1000 digits should be rejected by any parser.\n *\n * BUG: The async parser never calls resetInt()/resetFloat() which is where\n * validateIntegerLength()/validateFPLength() lives. Instead it calls\n * _valueComplete() which skips all number length validation.\n *\n * CWE-770: Allocation of Resources Without Limits or Throttling\n */\nclass AsyncParserNumberLengthBypassTest {\n\n private static final int MAX_NUMBER_LENGTH = 1000;\n private static final int TEST_NUMBER_LENGTH = 5000;\n\n private final JsonFactory factory = new JsonFactory();\n\n // CONTROL: Sync parser correctly rejects a number exceeding maxNumberLength\n @Test\n void syncParserRejectsLongNumber() throws Exception {\n byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);\n\t\t\n\t\t// Output to console\n System.out.println(\"[SYNC] Parsing \" + TEST_NUMBER_LENGTH + \"-digit number (limit: \" + MAX_NUMBER_LENGTH + \")\");\n try {\n try (JsonParser p = factory.createParser(ObjectReadContext.empty(), payload)) {\n while (p.nextToken() != null) {\n if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {\n System.out.println(\"[SYNC] Accepted number with \" + p.getText().length() + \" digits — UNEXPECTED\");\n }\n }\n }\n fail(\"Sync parser must reject a \" + TEST_NUMBER_LENGTH + \"-digit number\");\n } catch (StreamConstraintsException e) {\n System.out.println(\"[SYNC] Rejected with StreamConstraintsException: \" + e.getMessage());\n }\n }\n\n // VULNERABILITY: Async parser accepts the SAME number that sync rejects\n @Test\n void asyncParserAcceptsLongNumber() throws Exception {\n byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);\n\n NonBlockingByteArrayJsonParser p =\n (NonBlockingByteArrayJsonParser) factory.createNonBlockingByteArrayParser(ObjectReadContext.empty());\n p.feedInput(payload, 0, payload.length);\n p.endOfInput();\n\n boolean foundNumber = false;\n try {\n while (p.nextToken() != null) {\n if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {\n foundNumber = true;\n String numberText = p.getText();\n assertEquals(TEST_NUMBER_LENGTH, numberText.length(),\n \"Async parser silently accepted all \" + TEST_NUMBER_LENGTH + \" digits\");\n }\n }\n // Output to console\n System.out.println(\"[ASYNC INT] Accepted number with \" + TEST_NUMBER_LENGTH + \" digits — BUG CONFIRMED\");\n assertTrue(foundNumber, \"Parser should have produced a VALUE_NUMBER_INT token\");\n } catch (StreamConstraintsException e) {\n fail(\"Bug is fixed — async parser now correctly rejects long numbers: \" + e.getMessage());\n }\n p.close();\n }\n\n private byte[] buildPayloadWithLongInteger(int numDigits) {\n StringBuilder sb = new StringBuilder(numDigits + 10);\n sb.append(\"{\\\"v\\\":\");\n for (int i = 0; i \u003c numDigits; i++) {\n sb.append((char) ('1' + (i % 9)));\n }\n sb.append('}');\n return sb.toString().getBytes(StandardCharsets.UTF_8);\n }\n}\n\n```\n\n\n### Impact\nA malicious actor can send a JSON document with an arbitrarily long number to an application using the async parser (e.g., in a Spring WebFlux or other reactive application). This can cause:\n1. **Memory Exhaustion:** Unbounded allocation of memory in the `TextBuffer` to store the number's digits, leading to an `OutOfMemoryError`.\n2. **CPU Exhaustion:** If the application subsequently calls `getBigIntegerValue()` or `getDecimalValue()`, the JVM can be tied up in O(n^2) `BigInteger` parsing operations, leading to a CPU-based DoS.\n\n### Suggested Remediation\n\nThe async parsing path should be updated to respect the `maxNumberLength` constraint. The simplest fix appears to ensure that `_valueComplete()` or a similar method in the async path calls the appropriate validation methods (`resetInt()` or `resetFloat()`) already present in `ParserBase`, mirroring the behavior of the synchronous parsers.\n\n**NOTE:** This research was performed in collaboration with [rohan-repos](https://github.com/rohan-repos)","status":"published","published":"2026-02-28T02:01:05Z","modified":"2026-09-10T03:50:34.318297905Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"UBUNTU-CVE-2026-18401","description":"The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service. The synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on which parsing API the application uses. Root cause: the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods. Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never enforced on the async code path. Impact: an attacker sending a JSON document containing an arbitrarily long number to an application using the async parser (for example a Spring WebFlux or other reactive application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in O(n^2) BigInteger parsing, causing CPU-based denial of service. No privileges or user interaction beyond the ability to submit data for parsing are required. This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0.","status":"published","published":"2026-08-04T15:16:00Z","modified":"2026-10-17T12:59:53.54988529Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"CLSA-2026-1776386157","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.12.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-10-15T09:46:21.909900986Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1789484097","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 4 CVEs. Fixed in 2.17.2-tuxcare.1.","status":"published","published":"2026-09-15T14:54:57Z","modified":"2026-10-15T09:47:44.141909919Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1791447404","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.17.3-tuxcare.1.","status":"published","published":"2026-10-08T08:16:44Z","modified":"2026-10-15T09:45:40.789905876Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791485698","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.17.1-tuxcare.1.","status":"published","published":"2026-10-08T18:54:58Z","modified":"2026-10-15T09:47:44.954131074Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791493683","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.14.2-tuxcare.3.","status":"published","published":"2026-10-08T21:08:03Z","modified":"2026-10-15T09:47:44.974502436Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791495450","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.14.1-tuxcare.2.","status":"published","published":"2026-10-08T21:37:30Z","modified":"2026-10-15T09:47:45.015099683Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792399384","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.15.4-tuxcare.1.","status":"published","published":"2026-10-19T08:43:04Z","modified":"2026-10-27T13:43:05.899250218Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792399460","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.13.2-tuxcare.1.","status":"published","published":"2026-10-19T08:44:20Z","modified":"2026-10-19T13:30:05.756963318Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792399472","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.13.4-tuxcare.1.","status":"published","published":"2026-10-19T08:44:32Z","modified":"2026-10-19T13:30:02.67147981Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428564","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.18.5-tuxcare.1.","status":"published","published":"2026-10-19T16:49:24Z","modified":"2026-10-19T19:15:03.836079211Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792431620","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.16.1-tuxcare.1.","status":"published","published":"2026-10-19T17:40:20Z","modified":"2026-10-19T19:15:06.838786646Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792431627","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.15.0-tuxcare.1.","status":"published","published":"2026-10-19T17:40:27Z","modified":"2026-10-19T19:15:03.983395164Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792434304","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 4 CVEs. Fixed in 2.13.3-tuxcare.1.","status":"published","published":"2026-10-19T18:25:04Z","modified":"2026-10-20T01:45:04.533274398Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1793085045","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.18.4.1-tuxcare.2.","status":"published","published":"2026-10-27T07:10:45Z","modified":"2026-10-27T13:30:04.771226463Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793085177","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.20.1-tuxcare.1.","status":"published","published":"2026-10-27T07:12:57Z","modified":"2026-10-27T13:30:03.65513177Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793196863","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.19.4-tuxcare.1.","status":"published","published":"2026-10-28T14:14:23Z","modified":"2026-10-28T19:45:06.02646237Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"openSUSE-SU-2026:11638-1","title":"jackson-core-2.18.9-2.1 on GA media","description":"These are all security issues fixed in the jackson-core-2.18.9-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-29T00:00:00Z","modified":"2026-08-30T13:00:04.982815958Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:22034-1","title":"Security update for jackson-annotations, jackson-core, jackson-databind","description":"This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:\n\n- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues\n (bsc#1273856).\n- CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without restricting the URI\n scheme (bsc#1277883).\n- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).\n- CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).\n- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).\n- CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable` deserialization\n (bsc#1278008).\n- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).\n- CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for\n unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).\n- CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the raw, attacker-\n supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).\n- CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan of the pending-\n reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization\n (bsc#1282492).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.11\n\nChanges for jackson-core:\n\n- Update to 2.18.11\n * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,\n CVE-2026-89407)\n * #1698: UTF8DataInputJsonParser does not honor\n maxErrorTokenLength when reporting an unrecognized token\n (bsc#1282505, CVE-2026-89425)\n * #1642: Fix maxDocumentLength bypass in async parser\n single-feedInput() case [GHSA-2c4j-63jj-9fqr]\n * #1643: Enforce maxNameLength incrementally in\n ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)\n of async parser (bsc#1273857, CVE-2026-68494)\n non-blocking (async) parser (bsc#1273856, CVE-2026-18401)\n\nChanges for jackson-databind:\n\n- Update to 2.18.11\n * #6185: Bracket unresolved IPv6 host name in InetSocketAddress\n serialization\n * #6203: Prevent unbounded growth of type id cache in\n TypeDeserializer (bsc#1282491, CVE-2026-91776)\n * #6204: Avoid quadratic forward-reference resolution in\n Collection/Map deserializers (bsc#1282492, CVE-2026-91777)\n * #6099: Resolve classes without initialization in\n TypeFactory.findClass()\n * #6116: Reject non-ASCII digits in InetAddress literal validation\n * #6127: Add StreamReadConstraints number len constraint to\n javax.xml.datatype.XMLGregorianCalendar and\n javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)\n * #6129: Limit the supported URL schemes for java.nio.file.Path\n deserialization (bsc#1277883, CVE-2026-19032)\n * #6156: Add java.lang.Comparable in set of unsafe polymorphic\n base types (bsc#1278008, CVE-2026-83557)\n * #6165: Apply number length limits to BigDecimal/BigInteger/\n /Double/Float Map keys\n","status":"published","published":"2026-10-06T14:10:27Z","modified":"2026-10-09T17:23:14.417272976Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-18401","title":"CVE-2026-18401 in tools.jackson.core:jackson-core - Patched by Root","description":"Root has patched CVE-2026-18401 in the tools.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-03T12:50:06Z","modified":"2026-09-03T14:45:41.351550202Z","updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"ROOT-APP-MAVEN-GHSA-72hv-8253-57qq","title":"GHSA-72hv-8253-57qq in com.fasterxml.jackson.core:jackson-core - Patched by Root","description":"Root has patched GHSA-72hv-8253-57qq in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-11-05T08:30:29Z","modified":"2026-11-05T09:15:09.290559124Z","updated_at":"2026-11-05T13:31:49.170436Z"},{"id":"SUSE-SU-2026:24149-1","title":"Security update for jackson-annotations, jackson-core, jackson-databind","description":"This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:\n\n- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues\n (bsc#1273856).\n- CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without restricting the URI\n scheme (bsc#1277883).\n- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).\n- CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).\n- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).\n- CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable` deserialization\n (bsc#1278008).\n- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).\n- CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for\n unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).\n- CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the raw, attacker-\n supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).\n- CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan of the pending-\n reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization\n (bsc#1282492).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.11\n\nChanges for jackson-core:\n\n- Update to 2.18.11\n * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,\n CVE-2026-89407)\n * #1698: UTF8DataInputJsonParser does not honor\n maxErrorTokenLength when reporting an unrecognized token\n (bsc#1282505, CVE-2026-89425)\n * #1642: Fix maxDocumentLength bypass in async parser\n single-feedInput() case [GHSA-2c4j-63jj-9fqr]\n * #1643: Enforce maxNameLength incrementally in\n ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)\n of async parser (bsc#1273857, CVE-2026-68494)\n non-blocking (async) parser (bsc#1273856, CVE-2026-18401)\n\nChanges for jackson-databind:\n\n- Update to 2.18.11\n * #6185: Bracket unresolved IPv6 host name in InetSocketAddress\n serialization\n * #6203: Prevent unbounded growth of type id cache in\n TypeDeserializer (bsc#1282491, CVE-2026-91776)\n * #6204: Avoid quadratic forward-reference resolution in\n Collection/Map deserializers (bsc#1282492, CVE-2026-91777)\n * #6099: Resolve classes without initialization in\n TypeFactory.findClass()\n * #6116: Reject non-ASCII digits in InetAddress literal validation\n * #6127: Add StreamReadConstraints number len constraint to\n javax.xml.datatype.XMLGregorianCalendar and\n javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)\n * #6129: Limit the supported URL schemes for java.nio.file.Path\n deserialization (bsc#1277883, CVE-2026-19032)\n * #6156: Add java.lang.Comparable in set of unsafe polymorphic\n base types (bsc#1278008, CVE-2026-83557)\n * #6165: Apply number length limits to BigDecimal/BigInteger/\n /Double/Float Map keys\n","status":"published","published":"2026-10-06T14:12:21Z","modified":"2026-10-16T17:23:10.946637755Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4394-1","title":"Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base","description":"This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues:\n\n- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues\n (bsc#1273856).\n- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).\n- CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).\n- CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).\n- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).\n- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).\n- CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for\n unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.11\n\nChanges for jackson-bom:\n\n- Update to 2.18.11\n\nChanges for jackson-core:\n \n- Update to 2.18.11\n * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,\n CVE-2026-89407)\n * #1698: UTF8DataInputJsonParser does not honor\n maxErrorTokenLength when reporting an unrecognized token\n (bsc#1282505, CVE-2026-89425)\n * #1642: Fix maxDocumentLength bypass in async parser\n single-feedInput() case [GHSA-2c4j-63jj-9fqr]\n * #1643: Enforce maxNameLength incrementally in\n ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)\n of async parser (bsc#1273857, CVE-2026-68494)\n non-blocking (async) parser (bsc#1273856, CVE-2026-18401)\n\nChanges for jackson-databind:\n\n- Update to 2.18.11\n * #6185: Bracket unresolved IPv6 host name in InetSocketAddress\n serialization\n * #6203: Prevent unbounded growth of type id cache in\n TypeDeserializer (bsc#1282491, CVE-2026-91776)\n * #6204: Avoid quadratic forward-reference resolution in\n Collection/Map deserializers (bsc#1282492, CVE-2026-91777)\n * #6099: Resolve classes without initialization in\n TypeFactory.findClass()\n * #6116: Reject non-ASCII digits in InetAddress literal validation\n * #6127: Add StreamReadConstraints number len constraint to\n javax.xml.datatype.XMLGregorianCalendar and\n javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)\n * #6129: Limit the supported URL schemes for java.nio.file.Path\n deserialization (bsc#1277883, CVE-2026-19032)\n * #6156: Add java.lang.Comparable in set of unsafe polymorphic\n base types (bsc#1278008, CVE-2026-83557)\n * #6165: Apply number length limits to BigDecimal/BigInteger/\n /Double/Float Map keys\n\nChanges for jackson-dataformat-xml:\n\n- Update to 2.18.11\n * Fix build to avoid past-JDK-8 bytecode generation\n * #891: Enforce StreamReadConstraints.maxNestingDepth in\n FromXmlParser\n\nChanges for jackson-dataformats-binary:\n\n- Update to 2.18.11\n * #783: (protobuf) Support StreamReadConstraints.maxDocumentLength\n in ProtobufParser\n * #785: (avro) Support StreamReadConstraints.maxDocumentLength and\n maxTokenCount in Avro parser\n * #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion\n parser (partial fix for #358)\n * #805: (ion) Support StreamReadConstraints.maxDocumentLength in\n Ion parser (partial fix for #358)\n * #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser\n (bsc#1282639, CVE-2026-68495)\n * #726: (smile) Ensure maxNameLength limit enforced for Smile\n parser (bsc#1282640, CVE-2026-68496)\n * #727: (cbor) CBORParser.nextFieldName(SerializableString)\n confuses 5-bit length marker 23 with 24 ('1-byte length suffix\n follows')\n * #728: (cbor) CBORParser.nextFieldName(SerializableString)\n consumes Object entry slot twice on fast-path miss, truncating\n definite-length Objects\n * #733: (cbor) Long `String`s not added to 'stringref' reference\n table, breaking following references\n * #735: (cbor) 'stringref' property-name paths pass 5-bit length\n marker instead of actual length to shouldReferenceString()\n * #736: (cbor) Long Object property names added to 'stringref'\n reference table twice\n\nChanges for jackson-modules-base:\n\n- Update to 2.18.11\n","status":"published","published":"2026-09-29T11:53:06Z","modified":"2026-09-30T12:00:04.420797068Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}