The jackson-core asynchronous JSON parser's fix for a number length constraint bypass (GHSA-72hv-8253-57qq) is incomplete. While the fix validates integer length when a terminator byte or certain characters are encountered, it does not validate length when the parser runs out of input mid-integer and returns NOT_AVAILABLE. An attacker can exploit this by streaming JSON numbers in many small chunks without sending a terminator, causing the parser's internal text buffer to expand unboundedly, limited only by maxStringLength (default 20 MiB), which is about 20,000 times larger than the documented maxNumberLength (1000). This leads to memory exhaustion. The vulnerability affects jackson-core versions prior to 2.18.8, 2.19.0 to before 2.21.4, 2.22.0 to before 2.22.1, 3.0.0 to before 3.1.4, and 3.2.0 to before 3.2.1. The fraction parsing path correctly validates length on mid-input exhaustion, but the integer parsing path does not. No known exploits in the wild have been reported.

This vulnerability can cause unbounded memory allocation in the jackson-core asynchronous JSON parser when processing streamed JSON numbers without terminators, leading to potential memory exhaustion and denial of service. The amplification factor is approximately 20,000 times the intended maximum number length, significantly increasing the risk of resource exhaustion on affected systems. There is no indication of code execution or data corruption from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the data. Users should monitor jackson-core vendor advisories for updates addressing this incomplete fix. Until a patch is available, consider limiting input size or disabling asynchronous parsing if feasible to mitigate potential memory exhaustion.