Skip to content
Heist/ feed
High

jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service

Type: advisorySource: Official CVE List1 source record

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default. In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory. A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests c

Announced Source revision 1
Original source ↗

CVE-2026-68498

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-68498

jackson-core

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

jackson-core

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://github.com/FasterXML/jackson-core",
    "vendor": "FasterXML",
    "product": "jackson-core",
    "versions": [
      {
        "status": "affected",
        "version": "2.16.0",
        "lessThan": "2.18.10",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "2.18.10",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "2.19.0",
        "lessThan": "2.21.6",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "2.21.6",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "2.22.0",
        "lessThan": "2.22.2",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "2.22.2",
        "versionType": "maven"
      }
    ],
    "packageName": "com.fasterxml.jackson.core:jackson-core",
    "programFiles": [
      "src/main/java/com/fasterxml/jackson/core/json/ReaderBasedJsonParser.java"
    ],
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "ReaderBasedJsonParser._parseName2"
      }
    ]
  },
  {
    "repo": "https://github.com/FasterXML/jackson-core",
    "vendor": "FasterXML",
    "product": "jackson-core",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.0",
        "lessThan": "3.1.6",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "3.1.6",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "3.2.0",
        "lessThan": "3.2.2",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "3.2.2",
        "versionType": "maven"
      }
    ],
    "packageName": "tools.jackson.core:jackson-core",
    "programFiles": [
      "src/main/java/tools/jackson/core/json/ReaderBasedJsonParser.java"
    ],
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "ReaderBasedJsonParser._parseName2"
      }
    ]
  }
]
Related CVEs
CVE-2026-68498

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#42473 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement