Com.fasterxml.jackson.core:jackson core: jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq) (CVE-2026-68494)

The vulnerability (CVE-2026-68494) arises because the fix for a previous number length constraint bypass in jackson-core async parser did not cover the streaming path where the parser runs out of input mid-integer and returns NOT_AVAILABLE without validating the integer length. Attackers can exploit this by sending JSON numbers in many small chunks without terminators, causing the parser's internal buffer to expand unchecked up to the maxStringLength (default 20 MiB), amplifying the intended maxNumberLength limit (~1000) by about 20,000 times. The issue affects the NonBlockingUtf8JsonParserBase class in jackson-core versions before 2.18.8, certain 2.19.x and 2.21.x versions, and some 3.x versions. The fraction parsing path is correctly validated, but the integer digit path is not, leading to potential memory exhaustion.

This vulnerability can cause memory exhaustion in applications using the affected jackson-core async parser versions by allowing attackers to bypass the maxNumberLength limit and force the parser to allocate excessive memory. This can lead to denial of service due to resource exhaustion. There is no indication of code execution or data corruption. No known exploits in the wild have been reported.

A patch is available for this vulnerability. Users should upgrade to jackson-core versions 2.18.8 or later, 2.21.4 or later, 2.22.1 or later, 3.1.4 or later, or 3.2.1 or later as appropriate. The vendor advisory confirms that the vulnerability is fixed in these versions. Until upgraded, applications should avoid processing untrusted JSON streams in non-blocking mode or apply other application-level limits on input size.