The vulnerability arises from an incomplete fix in jackson-core versions 2.18.6 and 2.21.1 for a prior number length constraint bypass. The fix correctly validates number length on certain code paths but misses validation when the parser runs out of input mid-integer digit accumulation and returns NOT_AVAILABLE without checking length. An attacker can exploit this by streaming JSON numbers in small chunks indefinitely, causing the parser's internal buffer to expand up to the maxStringLength limit (default 20 MiB), which is about 20,000 times larger than the intended maxNumberLength (default 1000). This leads to unbounded memory allocation and potential denial of service. The issue affects multiple jackson-core versions including 2.18.x, 2.19.x through 2.21.3, 2.22.0, and 3.x branches as specified. The fraction number parsing path is correctly validated and not affected. The vulnerability is tracked as GHSA-r7wm-3cxj-wff9 and CWE-770.

An attacker can cause excessive memory consumption by sending specially crafted JSON streams that keep the parser in an integer digit accumulation state without terminators, leading to unbounded buffer growth. This can result in denial of service due to memory exhaustion. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Users should upgrade to fixed versions beyond the affected ranges to ensure the integer digit length validation is properly enforced in all code paths. The affected versions are: <2.18.8, >=2.19.0 <2.21.4, >=2.22.0 <2.22.1, >=3.0.0 <3.1.4, and >=3.2.0 <3.2.1. No additional mitigations are indicated by the vendor advisory.