jackson-core CVE-2026-18401

Exploitation requires that the target application uses jackson-core's non-blocking (async) parser API specifically - the synchronous parser correctly enforces maxNumberLength and is not affected. The async parser is typically used by reactive Java frameworks such as Spring WebFlux; traditional Spring MVC or servlet-based applications using the default synchronous parser are not vulnerable. The affected jackson-core version (2.15.0-2.18.5, 2.19.0-2.21.0, or 3.0.0-3.0.x) must be present on the classpath. No authentication, elevated privileges, or user interaction are required: the attacker needs only the ability to submit arbitrary JSON to a network-accessible endpoint backed by the async parser. Exploitation is limited to applications in the reactive/non-blocking I/O deployment pattern; traditional synchronous deployments are immune.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:L) scores 6.9, rating availability impact as Low. This appears conservative given the description explicitly states the attack can cause OutOfMemoryError and CPU-based DoS - outcomes typically associated with High availability impact. The discrepancy likely reflects that the impact is conditional on the application using the async parser code path; not all jackson-core deployments are vulnerable, which may have influenced the VA:L choice. A publicly available PoC (JUnit test in GHSA-72hv-8253-57qq) lowers the bar for exploitation. There is no CISA KEV listing and no EPSS data was provided, so exploitation breadth in the wild is unknown. Real-world priority is elevated for organizations running Spring WebFlux or other reactive Java stacks that expose public-facing JSON endpoints, where the combination of no-auth network access and a working PoC makes exploitation straightforward once the async parser is confirmed in use. Applications exclusively using the synchronous parser are fully unaffected regardless of jackson-core version.

An attacker identifies a Spring WebFlux application endpoint that parses JSON using jackson-core's async parser and submits a POST request containing a JSON number token composed of 5,000 or more digits. The NonBlockingUtf8JsonParserBase accumulates all digits into an unbounded TextBuffer without invoking maxNumberLength validation, causing rapid heap growth and an OutOfMemoryError that crashes or hangs the JVM process. If the application's response handler calls getBigIntegerValue() on the oversized token, the JVM additionally burns CPU in O(n²) BigInteger conversion, compounding the denial of service. A JUnit 5 PoC demonstrating this behavior against a 5,000-digit number is published in GHSA-72hv-8253-57qq.