Memory Exhaustion Vulnerability in Jackson Core by FasterXML

CVE-2026-68498

What is CVE-2026-68498?

A vulnerability exists in Jackson Core where the length of JSON Object property names is not properly validated, leading to potential memory exhaustion. The StreamReadConstraints.maxNameLength is set to 50,000 characters, but due to incorrect checks, an attacker can send excessively long names, resulting in memory allocation of up to approximately 100 MB. This exploitation can occur without authentication, especially under default configurations. Applications that parse untrusted JSON from sources like Strings or Readers are at risk, as this vulnerability does not affect byte-input parsers. Users of jackson-core version 2.16.0 and newer need to take action to mitigate this issue.

References