DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-R7WM-3CXJ-WFF9: GHSA-R7WM-3CXJ-WFF9: StreamReadConstraints Bypass in jackson-core Async Parser

#security #cve #cybersecurity #ghsa

GHSA-R7WM-3CXJ-WFF9: StreamReadConstraints Bypass in jackson-core Async Parser

Vulnerability ID: GHSA-R7WM-3CXJ-WFF9
CVSS Score: 5.3
Published: 2026-07-21

A critical validation bypass exists in FasterXML jackson-core due to an incomplete fix for GHSA-72hv-8253-57qq. When parsing JSON asynchronously using NonBlockingUtf8JsonParserBase, the StreamReadConstraints.maxNumberLength constraint is bypassed when numeric inputs are received in small, non-terminating chunks. The parser continually accumulates digit-only input in an internal buffer without triggering validation constraints, resulting in potential heap memory exhaustion and application-level Denial of Service.

TL;DR

An incomplete security fix in Jackson-core allows remote attackers to bypass numeric length limits via slow-drip asynchronous JSON streaming, causing memory exhaustion and Denial of Service.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770
  • Attack Vector: Network
  • CVSS: 5.3
  • EPSS Score: N/A
  • Impact: Denial of Service (DoS)
  • Exploit Status: Proof of Concept
  • KEV Status: Not Listed

Affected Systems

  • Applications utilizing FasterXML jackson-core async parsing on WebFlux/Netty/Vert.x infrastructure
  • jackson-core (Maven Standard): >= 2.18.6, < 2.19.2 (Fixed in: 2.19.2)
  • jackson-core (Maven Standard): >= 2.20.0, < 2.21.1 (Fixed in: 2.21.1)
  • jackson-core (Maven Tools): >= 3.0.0, < 3.1.0 (Fixed in: 3.1.0)

Code Analysis

Commit: 4cdd529

Validate accumulated integer length so far before yielding NOT_AVAILABLE in async parser

Commit: b0c428e

Initial number validation patch introducing _setIntLength and validation checks on token boundary

Mitigation Strategies

  • Upgrade jackson-core dependencies to patched releases
  • Enforce maximum string length limits in StreamReadConstraints
  • Deploy reverse-proxy rate limiting to prevent slow-drip streaming attacks

Remediation Steps:

  1. Update maven or gradle build configuration to use com.fasterxml.jackson.core:jackson-core version 2.19.2, 2.21.1 or later
  2. Configure StreamReadConstraints builder to explicitly drop maxStringLength to limit total worst-case allocation per stream
  3. Configure web gateway timeouts and minimum data rate checks to terminate slow-drip client connections

References

Read the full report for GHSA-R7WM-3CXJ-WFF9 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)