EOL Fix Available | CVE-2026-68494

Overview

jackson-core is the core streaming package of the FasterXML Jackson suite. It provides the low-level, incremental JSON parser and generator APIs (including the non-blocking/async parser) that jackson-databind and the wider Jackson ecosystem are built on, and is one of the most widely used JSON libraries for Java.

A Denial of Service (DoS) vulnerability (CVE-2026-68494) has been identified in jackson-core, which allows attackers to exhaust memory by streaming an unterminated numeric literal to the non-blocking (asynchronous) JSON parser in many small chunks, bypassing the configured number-length limit. It is the result of an incomplete fix for CVE-2026-18401, which enforced the limit when a numeric value completes but not while it is still being streamed.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects multiple versions of jackson-core, from 2.9.0 up to and including 2.18.7, and from 2.19.0 up to and including 2.21.3.

Details

Module Info

Product: jackson-core
Affected packages: com.fasterxml.jackson.core:jackson-core
Affected versions: >=2.9.0 <2.18.8, >=2.19.0 <2.21.4
GitHub repository: https://github.com/FasterXML/jackson-core
Published packages: https://central.sonatype.com/artifact/com.fasterxml.jackson.core/jackson-core
Package manager: Maven
Fixed in:
- NES for Jackson 2.13.9, 2.14.6, and 2.15.7
- OSS 2.18.8 and 2.21.4

Vulnerability Info

This High-severity vulnerability is found in the com.fasterxml.jackson.core:jackson-core package in multiple 2.x versions of jackson-core. To bound the resources a single document can consume, Jackson exposes StreamReadConstraints.maxNumberLength (default 1000 characters). The fix for CVE-2026-18401 wired this limit into the non-blocking (asynchronous) parser, obtained from JsonFactory.createNonBlockingByteArrayParser() or createNonBlockingByteBufferParser(), but only at the points where a numeric value is decided, that is, when a terminator byte, a decimal point, an exponent marker, or the declared end of input arrives. It missed the streaming-suspension exits on the integer path: when the parser runs out of fed input while still reading digits, it saves the accumulated digits and yields NOT_AVAILABLE without ever validating their length.

if (_inputPtr >= _inputEnd) {
    _minorState = MINOR_NUMBER_INTEGER_DIGITS;
    _textBuffer.setCurrentLength(outPtr);
    // no length validation before suspending on the integer path
    return (_currToken = JsonToken.NOT_AVAILABLE);
}

An attacker who feeds digit-only input in many small chunks and never sends a terminator keeps the parser on exactly these exits indefinitely, so the number-length check is never reached. The accumulated digits are only stopped by the much larger maxStringLength constraint (20 MiB by default) instead of the 1000-character maxNumberLength (roughly a 20,000-fold amplification), growing the parser's internal text buffer to tens of megabytes of heap per connection, which multiplied across concurrent attacker connections exhausts JVM memory. The non-blocking parser is the API used by reactive and streaming stacks such as Spring WebFlux, so any service that feeds untrusted JSON through it incrementally is exposed; the blocking parsers and fully-buffered async input are not affected by this issue. HeroDevs NES for Jackson had backported StreamReadConstraints to its 2.13.x and 2.14.x lines, so all three NES lines carried the same bypass and all three received the fix.

This vulnerability was introduced in 2017 with jackson-core 2.9.0, when the non-blocking parser was added with no number-length limit on its streaming integer path.

Mitigation

Only recent versions of Jackson Core are community-supported. The affected 2.13.x, 2.14.x, and 2.15.x lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

Upgrade jackson-core to a currently supported release that contains the fix, such as 2.18.8 or later.
Leverage a commercial support partner like HeroDevs for post-EOL security support.