Asynchronous JSON Parsing Flaw in Jackson Core Affects Applications

CVE-2026-18401

What is CVE-2026-18401?

The asynchronous JSON parser in Jackson Core fails to enforce the maximum number length constraint, allowing attackers to submit JSON with arbitrarily long number tokens. This oversight can lead to excessive memory use and CPU exhaustion, resulting in denial of service conditions. The synchronization limitations mean that this vulnerability does not affect all parsing methods equally, as the synchronous parser applies the limit correctly while the async parser does not, potentially compromising applications relying on the async parsing path.

References