CVE-2026-18401: jackson-core async JSON parser DoS via maxNumberLength bypass

CVE-2026-18401 Vulnerability Overview CNA: HeroDevs Title: Number length constraint bypass in the non-blocking (asynchronous) JSON parser in jackson-core can lead to denial of service Description: The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the constraint defined in (default: 1000 characters). Attackers can submit JSON with arbitrary length to applications using the asynchronous parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in denial of service. The synchronous parser correctly enforces this limit; therefore, the effectiveness of the limit depends on the parsing API used by the application. Root Cause: The and related classes in the asynchronous parsing path never invoke the number length validation methods. Number parsing methods such as accumulate the number into a without any length checks, then call to mark completion. does not call or , which are the methods in that perform and . Because the validation steps are skipped, is never enforced in the asynchronous code path. Impact: An attacker can send JSON documents containing numbers of arbitrary length to applications using the asynchronous parser (e.g., Spring WebFlux or other reactive applications), potentially causing unbounded allocations in or triggering . If the application subsequently calls or , the JVM may additionally experience O(n^2) BigInteger parsing overhead, leading to CPU-based denial of service. Privileges or User Interaction: None required, other than submitting the data to be parsed. Affected Scope CWE: CWE-770: Allocation of Resources Without Limits or Throttling CVSS: 6.9 (MEDIUM) Affected Products: - Vendor: FasterXML - Product: jackson-core - Versions: From 2.15.0 to 2.18.5 Remediation Fixed Versions: Versions 2.15.0 through 2.18.5 have patched this issue. Reference Links: - GitHub Advisory - GitHub Patch Credits Discoverers: sprabha7, rohan-repos Analysts: neilmadden-hazelcast, awsactran Fix Developer: pjfanning (PJ Fanning) Coordinator: cowtowncoder (Tatu Saloranta)

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-18401: jackson-core async JSON parser DoS via maxNumberLength bypass

More from this source