Integer Length Constraint Bypass in Jackson-core for Non-blocking JSON Parsing

CVE-2026-68494

What is CVE-2026-68494?

A vulnerability in Jackson-core allows attackers to exploit the non-blocking JSON parser, leading to potential heap exhaustion. The incomplete fix for a previous issue resulted in a scenario where attackers can stream JSON in small chunks without sending terminator bytes, causing the parser to remain indefinitely in a state that allows excessive memory usage. This results in a significant amplification of heap allocation beyond the documented number length limits, threatening the stability of the JVM when attacked through concurrent connections.

References