Threat Intelligence Database

CVE-2026-68494 is a high-severity vulnerability in FasterXML jackson-core affecting versions from 2.15.0 through 2.18.7, 2.19.0 through 2.21.3, 2.22.0, and certain 3.x versions. It involves incomplete validation of integer length in the non-blocking JSON parser, allowing an attacker to cause excessive memory allocation by streaming JSON numbers in many small chunks without terminators. This can lead to heap exhaustion in Java applications using asynchronous parsing, particularly reactive frameworks like Spring WebFlux and Vert.x. Exploitation requires only the ability to stream data to a parsing endpoint, with no privileges or user interaction needed. Synchronous parsers and async parsers on complete input are not affected. No official patch or remediation level is currently stated.

CVE-2026-18401 is a medium severity vulnerability in FasterXML jackson-core's asynchronous JSON parser. The async parser does not enforce the maxNumberLength constraint, allowing an attacker to submit JSON with arbitrarily long number tokens. This can cause excessive memory allocation and CPU exhaustion, leading to denial of service. The synchronous parser enforces this limit correctly, so the issue only affects applications using the async parser API. No privileges or user interaction beyond submitting JSON data are required. The vulnerability affects jackson-core versions 2.15.0 through 2.18.5, 2.19.0 through 2.21.0, and 3.0.0 through 3.0.x. Versions prior to 2.15.0 are not affected.

A vulnerability in the async JSON parser of jackson-core allows bypassing the maxNumberLength constraint, enabling parsing of arbitrarily long numbers. This leads to excessive memory allocation and potential CPU exhaustion, causing a Denial of Service (DoS). The synchronous parser enforces the limit correctly, but the async parser fails to validate number length due to skipped checks in its code path. This inconsistency creates a resource exhaustion risk when processing large numeric JSON values asynchronously.

An incomplete fix in jackson-core's asynchronous JSON parser allows an attacker to bypass the maxNumberLength limit by streaming JSON numbers in many small chunks without terminators, causing unbounded memory allocation. This affects the integer digit accumulation path in the parser, leading to potential memory exhaustion. The vulnerability impacts multiple jackson-core versions prior to patched releases. A patch is available to address this issue.