OutOfMemoryError Risk in FasterXML Jackson-Core due to Malformed Token Processing

CVE-2026-89425

What is CVE-2026-89425?

The FasterXML jackson-core library contains a vulnerability in its UTF8DataInputJsonParser, which processes malformed tokens without proper limitations, potentially leading to significant resource consumption. When a malformed token is supplied, the parser constructs an excessively long error message by appending Java identifier characters to a StringBuilder unchecked, resulting in a much larger memory footprint. This implementation flaw can trigger an OutOfMemoryError for the Java Virtual Machine (JVM), severely impacting application performance. The vulnerability is present in jackson-core starting from version 2.8.0 and is not mitigated by existing constraints for DataInput sources.

References