GHSA-R7WM-3CXJ-WFF9: StreamReadConstraints Bypass in jackson-core Async Parser

Vulnerability ID: GHSA-R7WM-3CXJ-WFF9
CVSS Score: 5.3
Published: 2026-07-21

A critical validation bypass exists in FasterXML jackson-core due to an incomplete fix for GHSA-72hv-8253-57qq. When parsing JSON asynchronously using NonBlockingUtf8JsonParserBase, the StreamReadConstraints.maxNumberLength constraint is bypassed when numeric inputs are received in small, non-terminating chunks. The parser continually accumulates digit-only input in an internal buffer without triggering validation constraints, resulting in potential heap memory exhaustion and application-level Denial of Service.

TL;DR

An incomplete security fix in Jackson-core allows remote attackers to bypass numeric length limits via slow-drip asynchronous JSON streaming, causing memory exhaustion and Denial of Service.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-770
• Attack Vector: Network
• CVSS: 5.3
• EPSS Score: N/A
• Impact: Denial of Service (DoS)
• Exploit Status: Proof of Concept
• KEV Status: Not Listed

Affected Systems

• Applications utilizing FasterXML jackson-core async parsing on WebFlux/Netty/Vert.x infrastructure
• jackson-core (Maven Standard): >= 2.18.6, < 2.19.2 (Fixed in: 2.19.2)
• jackson-core (Maven Standard): >= 2.20.0, < 2.21.1 (Fixed in: 2.21.1)
• jackson-core (Maven Tools): >= 3.0.0, < 3.1.0 (Fixed in: 3.1.0)

Code Analysis

Commit: 4cdd529

Validate accumulated integer length so far before yielding NOT_AVAILABLE in async parser

Commit: b0c428e

Initial number validation patch introducing _setIntLength and validation checks on token boundary

Mitigation Strategies

• Upgrade jackson-core dependencies to patched releases
• Enforce maximum string length limits in StreamReadConstraints
• Deploy reverse-proxy rate limiting to prevent slow-drip streaming attacks

Remediation Steps:

1. Update maven or gradle build configuration to use com.fasterxml.jackson.core:jackson-core version 2.19.2, 2.21.1 or later
2. Configure StreamReadConstraints builder to explicitly drop maxStringLength to limit total worst-case allocation per stream
3. Configure web gateway timeouts and minimum data rate checks to terminate slow-drip client connections

References

• GHSA-R7WM-3CXJ-WFF9 Advisory Page
• Parent Security Advisory GHSA-72hv-8253-57qq
• Jackson Core Main Project Repository

Read the full report for GHSA-R7WM-3CXJ-WFF9 on our website for more details including interactive diagrams and full exploit analysis.