com.fasterxml.jackson.dataformat/jackson-dataformat-smile: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in asynchronous parser

A flaw was found in jackson-dataformat-smile. A remote attacker can cause a Denial of Service DoS by submitting specially crafted binary data to an asynchronous parsing endpoint. The parser fails to validate length prefixes, allowing untrusted input to trigger integer overflows or excessive memor...

com.fasterxml.jackson.dataformat/jackson-dataformat-smile: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in asynchronous parser

A flaw was found in jackson-dataformat-smile. A remote attacker can cause a Denial of Service DoS by submitting specially crafted binary data to an asynchronous parsing endpoint. The parser fails to validate length prefixes, allowing untrusted input to trigger integer overflows or excessive memor...

com.fasterxml.jackson.dataformat/jackson-dataformat-smile: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in asynchronous parser

A flaw was found in jackson-dataformat-smile. A remote attacker can cause a Denial of Service DoS by submitting specially crafted binary data to an asynchronous parsing endpoint. The parser fails to validate length prefixes, allowing untrusted input to trigger integer overflows or excessive memor...

com.fasterxml.jackson.dataformat/jackson-dataformat-smile: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in asynchronous parser

A flaw was found in jackson-dataformat-smile. A remote attacker can cause a Denial of Service DoS by submitting specially crafted binary data to an asynchronous parsing endpoint. The parser fails to validate length prefixes, allowing untrusted input to trigger integer overflows or excessive memor...

SUSE CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

UBUNTU-CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

CVE-2026-18401 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

Security Bulletin: Vulnerability in jackson-core-2.15.2.jar

Summary Vulnerability in jackson-core-2.15.2.jar Vulnerability Details ID:WS-2026-0003 DESCRIPTION: The non-blocking async JSON parser in jackson-core bypasses the maxNumberLength constraint default: 1000 characters defined in StreamReadConstraints. This allows an attacker to send JSON with...

Security Bulletin: IBM SPSS Modeler is affected by a jackson-core async parser DoS vulnerability (WS-2026-0003)

Summary IBM SPSS Modeler is affected by a jackson-core async parser DoS vulnerability WS-2026-0003. This has been addressed in the remediation section. Vulnerability Details ID:WS-2026-0003 DESCRIPTION: The non-blocking async JSON parser in jackson-core bypasses the maxNumberLength constraint...