Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-04T14:39:14 com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller. As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes. The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase. Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected. Exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed. This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08).

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.

This is an Important denial of service vulnerability in `jackson-core`'s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input. Cryostat 4 Affected jackson-core OpenShift Developer Tools and Services Affected jenkins OpenShift Developer Tools and Services Affected jenkins-2-plugins OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel8 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-ekb-dispatcher-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-ekb-receiver-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-cuda-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-gaudi-rhel9 Red Hat AMQ Broker 7 Affected amq-broker-bin.zip Red Hat AMQ Broker 7 Affected amq-broker-maven-repository.zip Red Hat AMQ Clients Affected jackson-core Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-24/de-minimal-rhel8 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-24/de-minimal-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-25/de-minimal-rhel8 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-25/de-minimal-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-26/de-minimal-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/de-minimal-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/de-supported-rhel9 Red Hat Ansible Automation Platform 2 Not affected python3.11-drools-jpy-jar Red Hat Ansible Automation Platform 2 Affected python3.12-drools-jpy-jar Red Hat Ansible Automation Platform 2 Not affected python3x-drools-jpy-jar Red Hat Ansible Automation Platform 2 Not affected python-drools-jpy-jar Red Hat build of Apache Camel 4 for Quarkus 3 Affected jackson-core Red Hat build of Apache Camel for Spring Boot 4 Affected rhaf-camel-for-springboot-maven-repository.zip Red Hat build of Apache Camel for Spring Boot 4 Affected rhaf-camel-maven-repository.zip Red Hat build of Apache Camel for Spring Boot 4 Affected rhaf-camel-spring-boot-maven-repository.zip Red Hat build of Apache Camel - HawtIO 4 Affected jackson-core Red Hat build of Apicurio Registry 3 Affected jackson-core Red Hat build of Debezium 3 Affected debezium-maven-repository.zip Red Hat build of Debezium 3 Affected debezium-server.zip Red Hat Build of Keycloak Affected rhbk-keycloak-rhel9-operator/rhbk-keycloak-rhel9-operator Red Hat Build of Keycloak Affected rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 Red Hat Build of Keycloak Affected rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Build of Keycloak Affected rhbk-quarkus-dist.zip Red Hat Build of Keycloak Affected rhbk-rhel9-operator/rhbk-rhel9-operator Red Hat build of Quarkus Affected jackson-core Red Hat Certificate System 10 Affected redhat-pki:10/redhat-pki Red Hat Certificate System 11 Affected redhat-pki Red Hat Data Grid 8 Affected datagrid-datagrid-8-rhel9/datagrid-datagrid-8-rhel9 Red Hat Data Grid 8 Affected redhat-datagrid-maven-repository.zip Red Hat Data Grid 8 Affected redhat-datagrid-server.zip Red Hat Enterprise Linux 10 Not affected dogtag-pki Red Hat Enterprise Linux 8 Affected pki-core:10.6/pki-core Red Hat Enterprise Linux 9 Affected pki-core Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat JBoss Enterprise Application Platform 7 Affected eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Affected eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Affected eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Affected jboss-eap-7-eap74-els-openjdk11-openshift-rhel8/jboss-eap-7-eap74-els-openjdk11-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Affected jboss-eap-7-eap74-els-openjdk17-openshift-rhel8/jboss-eap-7-eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Affected jboss-eap-full-maven-repository.zip Red Hat JBoss Enterprise Application Platform 7 Affected jboss-eap-incremental-maven-repository.zip Red Hat JBoss Enterprise Application Platform 7 Affected jboss-eap-maven-repository.zip Red Hat JBoss Enterprise Application Platform 7 Affected jboss-eap-patch.zip Red Hat JBoss Enterprise Application Platform 7 Affected jboss-eap-runtime-maven-repository.zip Red Hat JBoss Enterprise Application Platform 8 Affected jboss-eap.1-runtime-maven-repository.zip Red Hat JBoss Enterprise Application Platform 8 Affected jboss-eap-runtime-maven-repository.zip Red Hat JBoss Enterprise Application Platform Expansion Pack Affected jackson-core Red Hat JBoss Web Server 7 Affected jboss-webserver-7-jws70-openjdk17-openshift-rhel9/jboss-webserver-7-jws70-openjdk17-openshift-rhel9 Red Hat JBoss Web Server 7 Affected jboss-webserver-7-jws70-openjdk21-openshift-rhel9/jboss-webserver-7-jws70-openjdk21-openshift-rhel9 Red Hat JBoss Web Server 7 Affected jws70-openjdk17-rhel9-openshift/jws70-openjdk17-rhel9-openshift Red Hat JBoss Web Server 7 Affected jws70-openjdk21-rhel9-openshift/jws70-openjdk21-rhel9-openshift Red Hat Lightspeed for Runtimes Operator Affected rh-lightspeed-runtimes/runtimes-agent-init-rhel9 Red Hat Offline Knowledge Portal Affected offline-knowledge-portal/rhokp-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-modelmesh-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-vllm-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/multicluster-redirector-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/pluginregistry-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/server-rhel9 Red Hat Satellite 6 Affected candlepin Red Hat Satellite 6 Affected openvox-server Red Hat Satellite 6 Affected puppetserver Red Hat Satellite 6 Affected satellite:el8/candlepin Red Hat Satellite 6 Affected satellite:el8/puppetserver Red Hat Single Sign-On 7 Affected jackson-core streams for Apache Kafka 2 Affected jackson-core streams for Apache Kafka 3 Affected jackson-core https://www.cve.org/CVERecord?id=CVE-2026-68494 https://nvd.nist.gov/vuln/detail/CVE-2026-68494 https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641 https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8 https://github.com/FasterXML/jackson-core/pull/1611 https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9 https://github.com/advisories/GHSA-72hv-8253-57qq https://www.cve.org/CVERecord?id=CVE-2026-18401