CVE-2026-68498
Description
A flaw was found in jackson-core. When parsing JSON data from character-based inputs, the parser does not enforce configured property name length limits while reading object keys into memory. A remote, unauthenticated attacker can exploit this flaw by submitting a crafted JSON payload containing an excessively long property name. Processing such input can exhaust system memory, causing the application to crash and resulting in a Denial of Service (DoS).
Statement
A flaw was found in jackson-core. When parsing JSON from character-based inputs (such as Reader, String, or char[]), ReaderBasedJsonParser fails to enforce the configured StreamReadConstraints.maxNameLength limit during name accumulation, validating against the larger maxStringLength limit instead. A remote, unauthenticated attacker can exploit this flaw by sending a crafted JSON object containing an excessively long property name, forcing allocations up to 100 million characters. This can cause heap exhaustion and an Out-Of-Memory application crash, resulting in a denial of service within standard process and container boundaries.
Mitigation
Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
