The vulnerability is a bypass of the maxNumberLength constraint in the non-blocking async JSON parser of jackson-core due to an incomplete fix for CVE-2026-18401. The parser fails to validate integer length when input is streamed in small chunks without a terminator byte, causing the internal buffer to grow up to the maxStringLength limit (20 MiB by default) instead of the intended maxNumberLength (1000 by default). This can lead to excessive heap memory consumption per connection, enabling denial-of-service conditions in reactive frameworks that feed data incrementally to the parser. The affected versions include jackson-core 2.15.0 through 2.18.7, 2.19.0 through 2.21.3, 2.22.0, and 3.0.0 through 3.1.3 and 3.2.0. The issue does not affect synchronous parsers or async parsers on complete input.

An attacker can cause excessive memory consumption on servers using the affected async parser by streaming JSON numbers in many small chunks without terminators. This can exhaust JVM heap memory and potentially cause denial of service. No privileges or user interaction are required for exploitation. Reactive frameworks such as Spring WebFlux, Reactor, Quarkus, Helidon, and Vert.x that use the async parser in this manner are vulnerable. Synchronous parsers and async parsers operating on complete input are not impacted.

No official patch links are provided in the advisory, and the advisory notes this is a duplicate of GHSA-r7wm-3cxj-wff9 which should be consulted for remediation status. Patch status is not yet confirmed — check the vendor advisory GHSA-r7wm-3cxj-wff9 for current remediation guidance. Operators should monitor vendor communications for updates and consider mitigating exposure by limiting concurrent connections or disabling async parsing of untrusted streamed input until a fix is confirmed.