{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/fasterxml/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["jackson-core (2.18.6)","jackson-core (2.21.1)","jackson-core (3.0.x)","jackson-core (3.1.x)"],"_cs_severities":["medium"],"_cs_tags":["java","json","serialization","memory-exhaustion","denial-of-service"],"_cs_type":"advisory","_cs_vendors":["FasterXML"],"content_html":"\u003cp\u003eA critical vulnerability exists in \u003ccode\u003ejackson-core\u003c/code\u003e versions 2.18.6 and 2.21.1 (and presumed in 3.0.x/3.1.x), which represents an incomplete fix for GHSA-72hv-8253-57qq, initially published in February 2026. This flaw primarily impacts reactive applications that utilize \u003ccode\u003ejackson-core\u003c/code\u003e's non-blocking JSON parser, such as those built with Spring WebFlux, Quarkus, Helidon, or Vert.x JSON. The vulnerability allows an attacker to bypass the configured \u003ccode\u003emaxNumberLength\u003c/code\u003e constraint by sending JSON containing a large number in many small, non-terminating chunks. The parser's internal \u003ccode\u003e_textBuffer\u003c/code\u003e then continues to accumulate digits without proper validation, expanding up to the much larger \u003ccode\u003emaxStringLength\u003c/code\u003e (default 20 MiB), which is a roughly 20,000x amplification over the default \u003ccode\u003emaxNumberLength\u003c/code\u003e (1000). This uncontrolled memory growth can lead to severe memory exhaustion and denial-of-service conditions, impacting the availability of targeted applications.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker initiates an HTTP request to a vulnerable reactive application, sending a partial JSON payload that begins a large numeric value (e.g., \u003ccode\u003e{\u0026quot;value\u0026quot;:1\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application's \u003ccode\u003ejackson-core\u003c/code\u003e non-blocking JSON parser begins processing the initial data chunk.\u003c/li\u003e\n\u003cli\u003eThe attacker continues to send subsequent HTTP request chunks, each containing a small segment of digits, without ever sending a character that would terminate the number (e.g., '.', 'e', 'E', or '}' for object closure).\u003c/li\u003e\n\u003cli\u003eFor each incoming chunk of digits, the non-blocking parser's \u003ccode\u003e_textBuffer.expandCurrentSegment()\u003c/code\u003e continuously allocates more memory to accumulate the digits.\u003c/li\u003e\n\u003cli\u003eDue to an incomplete fix for GHSA-72hv-8253-57qq, the critical \u003ccode\u003evalidateIntegerLength\u003c/code\u003e check is not invoked when the parser runs out of input mid-integer, allowing the buffer to grow far beyond the intended \u003ccode\u003emaxNumberLength\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThis uncontrolled memory accumulation continues until the allocated memory reaches \u003ccode\u003emaxStringLength\u003c/code\u003e (default 20 MiB) or the application's Java Virtual Machine (JVM) experiences an Out-Of-Memory (OOM) error.\u003c/li\u003e\n\u003cli\u003eThe targeted application becomes unresponsive or crashes due to resource exhaustion, resulting in a denial-of-service for legitimate users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eApplications employing \u003ccode\u003ejackson-core\u003c/code\u003e's non-blocking JSON parser in reactive frameworks are critically vulnerable to denial-of-service (DoS) attacks. This includes widely used environments such as Spring WebFlux, Quarkus, Helidon, and Vert.x JSON. Attackers can exploit this bypass to force the application's JVM to allocate excessive memory, potentially leading to Out-Of-Memory (OOM) errors and application crashes. The \u003ccode\u003emaxNumberLength\u003c/code\u003e configuration, intended to prevent such attacks, is effectively ignored, allowing memory consumption to reach up to \u003ccode\u003emaxStringLength\u003c/code\u003e (20 MiB per connection by default), which represents a ~20,000-fold increase over the expected limit. This resource exhaustion severely impacts the availability and stability of affected services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003ejackson-core\u003c/code\u003e to a patched version immediately upon its release. Monitor the project's advisories for the official fix.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, consider implementing a custom patch derived from the fix branch to address the missing validation calls in \u003ccode\u003eNonBlockingUtf8JsonParserBase.java\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eReview and configure \u003ccode\u003eStreamReadConstraints\u003c/code\u003e in \u003ccode\u003eJsonFactory\u003c/code\u003e builder to enforce appropriate \u003ccode\u003emaxStringLength\u003c/code\u003e values. While this is a workaround for the number length issue, it can mitigate the overall memory ceiling.\u003c/li\u003e\n\u003cli\u003eEnable application-level logging for \u003ccode\u003eStreamConstraintsException\u003c/code\u003e events, particularly those related to \u003ccode\u003eNumber value length\u003c/code\u003e, to identify and alert on attempted exploitation or abnormal large number processing.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T22:01:19Z","date_published":"2026-07-21T22:01:19Z","id":"https://feed.craftedsignal.io/briefs/2026-07-jackson-core-async-parser-bypass/","summary":"An incomplete fix for GHSA-72hv-8253-57qq in `jackson-core` versions 2.18.6, 2.21.1, and potentially 3.0.x/3.1.x, allows attackers to bypass `maxNumberLength` constraints in the non-blocking JSON parser by streaming JSON numbers in small chunks, leading to unbounded memory accumulation and denial of service in reactive applications.","title":"Jackson-core Async Parser Max Number Length Bypass via Chunked Digit Accumulation","url":"https://feed.craftedsignal.io/briefs/2026-07-jackson-core-async-parser-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - FasterXML","version":"https://jsonfeed.org/version/1.1"}