The vulnerability arises because the fix for a previous number length constraint bypass (CVE-2026-18401) was incomplete. Specifically, the non-blocking parser's integer length validation is bypassed when the parser runs out of input inside the MINOR_NUMBER_INTEGER_DIGITS state and returns NOT_AVAILABLE without invoking validateIntegerLength(). An attacker streaming JSON numbers in many small chunks without terminators causes the parser's internal buffer to grow up to the maxStringLength limit (20 MiB by default), which is much larger than the intended maxNumberLength (1000 by default). This results in approximately 40 MiB heap usage per connection before validation triggers, enabling memory exhaustion via concurrent connections. The flaw affects the async parser in jackson-core versions 2.15.0 to 2.18.7, 2.19.0 to 2.21.3, and 3.0.0 to 3.1.3. Versions 2.22.x and 3.2.x are not affected as they include the fix from initial releases.

An attacker can cause excessive memory allocation in the asynchronous JSON parser by streaming JSON numbers in many small chunks without terminators, leading to heap exhaustion in Java Virtual Machines. This impacts reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon, and Vert.x that feed inbound HTTP or gRPC bytes to the async parser incrementally. The vulnerability does not require privileges or user interaction and can be exploited remotely by sending crafted input to a parsing endpoint. Synchronous parsers and async parsers operating on complete input are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Versions 2.22.x and 3.2.x include the fix from their initial releases and are not affected. Operators should upgrade to these or later versions once available. Until then, consider limiting concurrent connections or applying input size constraints at the application level to mitigate potential memory exhaustion. No official fix or temporary workaround is explicitly stated in the provided data.