The vulnerability resides in the UTF8DataInputJsonParser implementation within jackson-core. When parsing DataInput streams, an error message is built by repeatedly appending Java identifier characters to a StringBuilder with an unchecked loop. The built token is not subject to the error report configuration limit of 256 characters, causing the StringBuilder to grow indefinitely. This leads to an enormous exception message and excessive memory consumption, which can trigger an OutOfMemoryError and collapse the entire JVM. The flaw results in a denial of service condition; it does not provide direct code execution or data disclosure.

An affected product is FasterXML jackson-core. All releases that include the DataInput parser, from 2.8.0 onward through the 2.8.x to 2.17.x, 2.19.x, 2.20.x, and 3.0.x branches, lack the fix. Consumers should avoid these lines and migrate to one of the maintained releases. Fixed versions are 2.18.11, 2.21.7, 2.22.3 for the com.fasterxml.jackson.core lineage, or 3.1.7 and 3.2.3 in the tools.jackson.core lineage.

The CVSS score of 7.5 indicates a high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, implying that active exploitation is not currently known or widespread. However, the flaw is exploitable by supplying an oversized malformed token through JsonFactory.createParser(DataInput). The attacker must have the ability to provide input to the parser, which could be remote or local depending on the application context. Because no configuration setting mitigates the issue, a malicious payload can readily consume all available heap memory, leading to service disruption. The lack of active exploit code reduces immediate threat, but the high‑severity nature and the permanent denial of service potential warrant timely remediation.