CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

CVE-2026-89425

The FasterXML jackson-core library contains a vulnerability in the UTF8DataInputJsonParser._reportInvalidToken() method. The root cause is that this specific parser fails to honor ErrorReportConfiguration.getMaxErrorTokenLength() (default 256) when building error messages, unlike other sibling im...