Threats Tagged 'ghsa-r7wm-3cxj-wff9'

A vulnerability in the jackson-core library's asynchronous JSON parser allows an attacker to bypass the maxNumberLength limit by streaming JSON numbers in many small chunks without a terminator byte. This causes unbounded memory allocation in the parser's text buffer, leading to potential memory exhaustion. The issue affects multiple versions including 2.18.6 and 2.21.1, and similar code in 3.x versions is presumed vulnerable. The problem arises because the integer length validation is not invoked when the parser runs out of input mid-integer, unlike the fraction path which is correctly validated. This vulnerability is a partial bypass of a previous fix and results in approximately 20,000 times amplification of the allowed number length.