Skip to content
Threat Feed
Subscribe

Tag

Json

2 briefs RSS
medium advisory

Jackson-core Async Parser Max Number Length Bypass via Chunked Digit Accumulation

An incomplete fix for GHSA-72hv-8253-57qq in `jackson-core` versions 2.18.6, 2.21.1, and potentially 3.0.x/3.1.x, allows attackers to bypass `maxNumberLength` constraints in the non-blocking JSON parser by streaming JSON numbers in small chunks, leading to unbounded memory accumulation and denial of service in reactive applications.

jackson-core +3 java json serialization memory-exhaustion denial-of-service
1t
medium advisory

Bird-lg-go Unbounded JSON Decode Denial of Service (CVE-2026-45047)

Bird-lg-go is vulnerable to a denial-of-service (DoS) attack (CVE-2026-45047) where an unauthenticated remote attacker can cause an out-of-memory error by streaming an extremely large JSON payload to the apiHandler, leading to termination of the bird-lg-go daemon.

bird-lg-go denial-of-service json CVE-2026-45047 linux
2r 1t