The non-blocking (async) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints, unlike the synchronous parser. The async parser's number parsing methods accumulate digits without length checks and finalize tokens without calling the validation methods resetInt() or resetFloat(), which perform number length validation. Consequently, numbers exceeding the default 1000-digit limit are accepted, leading to excessive memory and CPU usage and potential Denial of Service. This issue affects jackson-core versions >=3.0.0 <3.1.0, >=2.19.0 <2.21.1, and >=2.15.0 <2.18.6. A proof-of-concept test demonstrates the async parser accepting a 5000-digit number, which the sync parser rejects.

An attacker can exploit this vulnerability by sending JSON payloads with extremely long numeric values to the async parser, causing excessive memory allocation and CPU consumption. This can result in a Denial of Service condition, impacting availability of applications using the affected jackson-core async parser versions. There are no known exploits in the wild as of the published date.

A patch is available for this vulnerability. Users should upgrade to fixed versions beyond the affected ranges to ensure the maxNumberLength constraint is enforced in the async parser. Until patched, avoid processing untrusted JSON input with the async parser or implement external input validation to limit number length.