jackson-core CVE-2026-68494

Exploitation requires network access to an endpoint backed by jackson-core's non-blocking async parser (NonBlockingUtf8JsonParserBase) that receives input incrementally - specifically the chunked-feed pattern used by reactive HTTP/gRPC servers such as Spring WebFlux/Reactor, Quarkus, Helidon, and Vert.x. The attacker must be able to stream digit-only JSON number data across multiple chunks without sending a terminator byte (no ., e/E, closing }, or endOfInput() signal), keeping the parser indefinitely in MINOR_NUMBER_INTEGER_DIGITS state. No authentication is required per CVSS vector PR:N. Synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on fully-buffered complete input are not affected - deployment must use the non-blocking parser in streaming mode. A meaningful heap exhaustion attack requires the ability to open multiple concurrent connections; a single connection is bounded by maxStringLength (~20 MiB, ~40 MiB heap with Java chars), which is disruptive but limited without concurrency.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) correctly reflects a network-accessible, unauthenticated, low-complexity availability attack - consistent with the description that 'exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.' No EPSS score is provided in the input data, so exploitation probability cannot be numerically quantified. No CISA KEV listing exists and no standalone public exploit code has been identified beyond the regression test included in PR #1611, indicating the vulnerability has not been confirmed as actively exploited at scale. However, the exploitation mechanism is mechanically trivial - stream digit bytes in small HTTP chunks, never close - making independent rediscovery highly plausible for any attacker aware of the original GHSA-72hv-8253-57qq advisory. The ~20,000x amplification and attacker-controlled concurrency mean modest bandwidth can exhaust JVM heap on exposed reactive services. Risk is concentrated in unauthenticated or lightly authenticated async JSON endpoints; services using synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) are explicitly unaffected. Operators who applied the 2.18.6 or 2.21.1 patch believing themselves protected against GHSA-72hv-8253-57qq remain vulnerable and face a false sense of remediation.

An attacker targets a Spring WebFlux REST endpoint that accepts arbitrary JSON and uses jackson-core's non-blocking parser internally. The attacker opens dozens of concurrent connections and on each sends a JSON payload beginning with {"v": followed by a continuous stream of digit bytes in small TCP segments - never sending a terminator, decimal point, or closing brace. On each chunk, the parser returns NOT_AVAILABLE and grows its TextBuffer accumulator without invoking validateIntegerLength(); with default settings, each connection accumulates up to ~40 MiB of heap before the validator fires at value completion. With 50 concurrent connections the attacker can drive approximately 2 GiB of heap pressure, triggering an OutOfMemoryError and crashing the JVM process.