Skip to content
Threat Feed
Subscribe

Product

Jackson-Core (3.1.x)

1 brief RSS
medium advisory

Jackson-core Async Parser Max Number Length Bypass via Chunked Digit Accumulation

An incomplete fix for GHSA-72hv-8253-57qq in `jackson-core` versions 2.18.6, 2.21.1, and potentially 3.0.x/3.1.x, allows attackers to bypass `maxNumberLength` constraints in the non-blocking JSON parser by streaming JSON numbers in small chunks, leading to unbounded memory accumulation and denial of service in reactive applications.

jackson-core +3 java json serialization memory-exhaustion denial-of-service
1t