The vulnerability arises because the fix for a previous integer length constraint bypass (CVE-2026-18401) in jackson-core was incomplete. Specifically, the validateIntegerLength() function is not invoked on a code path where the non-blocking parser runs out of input inside the MINOR_NUMBER_INTEGER_DIGITS state and returns NOT_AVAILABLE. An attacker streaming JSON numbers in many small chunks without terminators can keep the parser in this state indefinitely, causing the internal text buffer to expand repeatedly and consume memory up to approximately 40 MiB per connection, bypassing the intended maxNumberLength limit by roughly 20,000 times. This affects asynchronous parsers used in reactive frameworks that feed inbound bytes incrementally. The synchronous parsers and async parsers on complete input are unaffected. The affected versions include jackson-core 2.15.0 through 2.18.7, 2.19.0 through 2.21.3, 2.22.0, and 3.x versions 3.0.0 through 3.1.3 and 3.2.0. Versions prior to 2.15.0 are not affected as the maxNumberLength constraint was introduced in 2.15.0. No official patch or remediation guidance is currently available.

This vulnerability can lead to denial of service by exhausting the Java Virtual Machine heap memory when an attacker streams JSON data in small chunks to a non-blocking parser endpoint. The memory consumption can grow significantly beyond the configured maxNumberLength limit due to the incomplete validation, potentially impacting applications using asynchronous JSON parsing in reactive frameworks. No privileges or user interaction are required for exploitation. Synchronous parsers and async parsers on complete input are not vulnerable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, operators should be aware that setting StreamReadConstraints.maxNumberLength does not fully prevent memory exhaustion in asynchronous parsing scenarios. Consider applying external rate limiting or input size restrictions on streaming JSON inputs to mitigate potential exploitation.