The vulnerability arises from UTF8DataInputJsonParser._reportInvalidToken() in jackson-core, which constructs error messages by appending Java identifier characters in a loop without limit. Unlike other parser implementations, it does not respect the configured maximum error token length, allowing a malformed token supplied through JsonFactory.createParser(DataInput) to be accumulated in full. This unbounded accumulation causes the StringBuilder to grow excessively, incurring memory expansion and potentially causing JVM OutOfMemoryError. The issue was introduced in version 2.8.0 with the addition of UTF8DataInputJsonParser and affects all subsequent versions up to 3.2.2 as specified. Existing constraints like maxDocumentLength and maxStringLength do not mitigate this path.

The vulnerability can cause denial of service by exhausting JVM memory resources when processing large malformed tokens via the DataInput parsing path. This leads to OutOfMemoryError crashes, impacting application availability. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid parsing untrusted or excessively large DataInput sources with jackson-core versions 2.8.0 through 3.2.2. Consider alternative parsing methods or input validation to limit token size. Monitor vendor communications for official patches or updates.