Threat Intelligence Database

CVE-2026-18401 is a medium severity vulnerability in FasterXML jackson-core affecting the asynchronous JSON parser. The async parser does not enforce the maxNumberLength constraint, allowing an attacker to submit JSON with arbitrarily long number tokens. This leads to excessive memory allocation and potential CPU exhaustion, causing denial of service. The synchronous parser is not affected as it enforces this limit correctly. No privileges or user interaction beyond submitting JSON data are required. The issue affects jackson-core versions 2.15.0 through 2.18.5, 2.19.0 through 2.21.0, and 3.0.0 through 3.0.x. Patch status is not confirmed; no official fix or remediation level is stated in the vendor advisory.

CVE-2026-68494 is a high-severity vulnerability in FasterXML jackson-core affecting versions from 2.15.0 through 2.18.7, 2.19.0 through 2.21.3, and 3.0.0 through 3.1.3. It involves improper resource allocation without limits in the non-blocking JSON parser, allowing an attacker to cause excessive memory consumption by streaming JSON numbers in many small chunks without terminators. This can lead to JVM heap exhaustion in reactive frameworks using the async parser. The issue does not affect synchronous parsers or async parsers operating on complete input. Exploitation requires only the ability to stream data to a parsing endpoint and no privileges.

An incomplete fix in jackson-core's asynchronous JSON parser allows an attacker to bypass the maxNumberLength limit by streaming JSON numbers in many small chunks without terminators, causing unbounded memory allocation. This affects the integer digit accumulation path in the parser, leading to potential memory exhaustion. The vulnerability impacts multiple jackson-core versions prior to patched releases. A patch is available to address this issue.

A vulnerability in the async JSON parser of jackson-core allows bypassing the maxNumberLength constraint, enabling parsing of arbitrarily long numbers. This leads to excessive memory allocation and potential CPU exhaustion, causing a Denial of Service (DoS). The synchronous parser enforces the limit correctly, but the async parser fails to validate number length due to skipped checks in its code path. This inconsistency creates a resource exhaustion risk when processing large numeric JSON values asynchronously.