Skip to content
Threat Feed
Subscribe

Tag

Json

3 briefs RSS
low advisory

Denial of Service via Unbounded Numeric Deserialization in Jackson Databind

A vulnerability in jackson-databind allows unauthenticated attackers to cause CPU exhaustion and denial of service by supplying specially crafted strings that bypass length constraints during XML datatype deserialization.

jackson-databind +14 denial-of-service vulnerability deserialization library-vulnerability java json cve-2026-91777 memory-exhaustion +1
1t 1c updated
medium advisory

Jackson-core Async Parser Max Number Length Bypass via Chunked Digit Accumulation

An incomplete fix for GHSA-72hv-8253-57qq in `jackson-core` versions 2.18.6, 2.21.1, and potentially 3.0.x/3.1.x, allows attackers to bypass `maxNumberLength` constraints in the non-blocking JSON parser by streaming JSON numbers in small chunks, leading to unbounded memory accumulation and denial of service in reactive applications.

jackson-core +3 java json serialization memory-exhaustion denial-of-service
1t
medium advisory

Bird-lg-go Unbounded JSON Decode Denial of Service (CVE-2026-45047)

Bird-lg-go is vulnerable to a denial-of-service (DoS) attack (CVE-2026-45047) where an unauthenticated remote attacker can cause an out-of-memory error by streaming an extremely large JSON payload to the apiHandler, leading to termination of the bird-lg-go daemon.

bird-lg-go denial-of-service json CVE-2026-45047 linux
2r 1t