The vulnerability arises because the asynchronous (non-blocking) JSON parser in jackson-core does not apply the maxNumberLength limit defined in StreamReadConstraints, which defaults to 1000 characters. In the async parsing path, number length validation methods are never invoked, allowing an attacker to supply a number token of arbitrary length. This causes unbounded memory allocation in the internal TextBuffer and can lead to OutOfMemoryError. Additionally, if the application calls getBigIntegerValue() or getDecimalValue() on such large numbers, the JVM may experience CPU exhaustion due to O(n^2) complexity in BigInteger parsing. The synchronous parser path enforces the limit correctly, so the issue is specific to the async parser API. This affects jackson-core versions starting from 2.15.0 (when StreamReadConstraints was introduced) through 2.18.5, 2.19.0 through 2.21.0, and 3.0.0 through 3.0.x. Versions prior to 2.15.0 are not affected. No privileges or user interaction beyond submitting JSON data are required for exploitation.

An attacker able to submit JSON data to an application using the asynchronous jackson-core parser can cause excessive memory allocation leading to OutOfMemoryError and potential CPU exhaustion due to inefficient BigInteger parsing. This results in denial of service conditions. No elevated privileges or user interaction beyond data submission are needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications using the asynchronous jackson-core parser should consider avoiding the async parser API or implement application-level limits on JSON number token lengths. Monitoring and filtering input JSON to reject excessively long number tokens can mitigate the risk.