{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89425", "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "state": "PUBLISHED", "assignerShortName": "HeroDevs", "dateReserved": "2026-09-11T18:31:50.311Z", "datePublished": "2026-09-23T02:06:10.571Z", "dateUpdated": "2026-09-23T02:06:10.571Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "shortName": "HeroDevs", "dateUpdated": "2026-09-23T02:06:10.571Z"}, "title": "jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "type": "CWE"}]}], "affected": [{"vendor": "FasterXML", "product": "jackson-core", "collectionURL": "https://repo1.maven.org/maven2", "packageName": "com.fasterxml.jackson.core:jackson-core", "repo": "https://github.com/FasterXML/jackson-core", "programRoutines": [{"name": "com.fasterxml.jackson.core.json.UTF8DataInputJsonParser._reportInvalidToken"}], "versions": [{"status": "affected", "version": "2.8.0", "lessThanOrEqual": "2.18.10", "versionType": "maven"}, {"status": "affected", "version": "2.19.0", "lessThanOrEqual": "2.21.6", "versionType": "maven"}, {"status": "affected", "version": "2.22.0", "lessThanOrEqual": "2.22.2", "versionType": "maven"}], "defaultStatus": "unaffected"}, {"vendor": "FasterXML", "product": "jackson-core", "collectionURL": "https://repo1.maven.org/maven2", "packageName": "tools.jackson.core:jackson-core", "repo": "https://github.com/FasterXML/jackson-core", "programRoutines": [{"name": "tools.jackson.core.json.UTF8DataInputJsonParser._reportInvalidToken"}], "versions": [{"status": "affected", "version": "3.0.0", "lessThanOrEqual": "3.1.6", "versionType": "maven"}, {"status": "affected", "version": "3.2.0", "lessThanOrEqual": "3.2.2", "versionType": "maven"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.</p>"}]}], "references": [{"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf", "name": "GHSA-7hhh-6rmp-j9qf", "tags": ["vendor-advisory"]}, {"url": "https://github.com/FasterXML/jackson-core/pull/1698", "name": "FasterXML/jackson-core#1698", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "workarounds": [{"lang": "en", "value": "No StreamReadConstraints or ErrorReportConfiguration setting mitigates this issue on the affected code path. Where possible, avoid JsonFactory.createParser(DataInput) for attacker-supplied content and use createParser(InputStream), createParser(Reader) or a byte-array overload instead; those parser implementations enforce maxErrorTokenLength correctly. Otherwise, bound input size ahead of the parser and cap JVM heap so that a single request cannot exhaust process memory.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>No StreamReadConstraints or ErrorReportConfiguration setting mitigates this issue on the affected code path. Where possible, avoid JsonFactory.createParser(DataInput) for attacker-supplied content and use createParser(InputStream), createParser(Reader) or a byte-array overload instead; those parser implementations enforce maxErrorTokenLength correctly. Otherwise, bound input size ahead of the parser and cap JVM heap so that a single request cannot exhaust process memory.</p>"}]}], "solutions": [{"lang": "en", "value": "Upgrade to com.fasterxml.jackson.core:jackson-core 2.18.11, 2.21.7 or 2.22.3, or to tools.jackson.core:jackson-core 3.1.7 or 3.2.3. The 2.8.x through 2.17.x, 2.19.x, 2.20.x and 3.0.x lines received no fix on their own branch and are no longer maintained upstream; consumers of those lines must move forward to a maintained release.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade to com.fasterxml.jackson.core:jackson-core 2.18.11, 2.21.7 or 2.22.3, or to tools.jackson.core:jackson-core 3.1.7 or 3.2.3. The 2.8.x through 2.17.x, 2.19.x, 2.20.x and 3.0.x lines received no fix on their own branch and are no longer maintained upstream; consumers of those lines must move forward to a maintained release.</p>"}]}], "credits": [{"lang": "en", "value": "manqingzhou", "type": "finder"}]}}}

{}

{}

{}

{}