CVE-2026-18401: Allocation of Resources Without Limits or Throttling

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

PT-2026-21386

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=480987597 Crash type: Security exception Crash state: com.ctc.wstx.util.TextBuffer.buildResultArray com.ctc.wstx.util.TextBuffer.contentsAsArray com.ctc.wstx.dtd.FullDTDReader.parseEntityValue...

maven-model:Xpp3ReaderFuzzer: Security exception in com.ctc.wstx.util.TextBuffer.buildResultArray

Detailed Report: https://oss-fuzz.com/testcase?key=5087299947003904 Project: maven-model Fuzzing Engine: libFuzzer Fuzz Target: Xpp3ReaderFuzzer Job Type: libfuzzerasanmaven-model Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

maven-model:Xpp3ReaderFuzzer: Security exception in com.ctc.wstx.util.TextBuffer.buildResultArray

Project: https://github.com/apache/maven.git Detailed Report: https://oss-fuzz.com/testcase?key=6001594882916352 Project: maven-model Fuzzing Engine: libFuzzer Fuzz Target: Xpp3ReaderFuzzer Job Type: libfuzzerasanmaven-model Platform Id: linux Crash Type: Security exception Crash Address: Crash...

OSV-2024-24 Security exception in java.base/java.util.Arrays.copyOf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65740 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOf com.fasterxml.jackson.core.util.TextBuffer.expandCurrentSegment com.fasterxml.jackson.dataformat.cbor.CBORParser.finishShortText...

PT-2024-40687 · Fasterxml · Jackson Dataformat Cbor

Name of the Vulnerable Software and Affected Versions: Jackson dataformat CBOR affected versions not specified Description: The issue is related to a security exception in the Jackson dataformat CBOR library. The crash occurs in the java.base/java.util.Arrays.copyOf method, which is called by...

jackson-dataformats-binary:CborParserFuzzer: Security exception in java.base/java.util.Arrays.copyOf

Project: https://github.com/FasterXML/jackson-dataformats-binary.git Detailed Report: https://oss-fuzz.com/testcase?key=5142631663337472 Project: jackson-dataformats-binary Fuzzing Engine: libFuzzer Fuzz Target: CborParserFuzzer Job Type: libfuzzerasanjackson-dataformats-binary Platform Id: linux...

jackson-datatypes-collections:GuavaSerializerFuzzer: Security exception in com.fasterxml.jackson.core.util.TextBuffer.carr

Project: https://github.com/FasterXML/jackson-datatypes-collections.git Detailed Report: https://oss-fuzz.com/testcase?key=5116391979876352 Project: jackson-datatypes-collections Fuzzing Engine: libFuzzer Fuzz Target: GuavaSerializerFuzzer Job Type: libfuzzerasanjackson-datatypes-collections...

jackson-datatypes-collections:GuavaSerializerFuzzer: Security exception in java.base/java.lang.AbstractStringBuilder.<init>

Project: https://github.com/FasterXML/jackson-datatypes-collections.git Detailed Report: https://oss-fuzz.com/testcase?key=4856038293372928 Project: jackson-datatypes-collections Fuzzing Engine: libFuzzer Fuzz Target: GuavaSerializerFuzzer Job Type: libfuzzerasanjackson-datatypes-collections...

jackson-core:JsonFuzzer: Uncaught exception in java.base/java.util.Arrays.copyOf

Project: https://github.com/FasterXML/jackson-core.git Detailed Report: https://oss-fuzz.com/testcase?key=6237354823122944 Project: jackson-core Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanjackson-core Platform Id: linux Crash Type: Uncaught exception Crash Address:...

jackson-core:JsonFuzzer: Uncaught exception in java.base/java.lang.String.<init>

Project: https://github.com/FasterXML/jackson-core.git Detailed Report: https://oss-fuzz.com/testcase?key=5397503563399168 Project: jackson-core Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanjackson-core Platform Id: linux Crash Type: Uncaught exception Crash Address:...