{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89425", "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "state": "PUBLISHED", "assignerShortName": "HeroDevs", "dateReserved": "2026-09-11T18:31:50.311Z", "datePublished": "2026-09-23T02:06:10.571Z", "dateUpdated": "2026-09-23T02:06:10.571Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "shortName": "HeroDevs", "dateUpdated": "2026-09-23T02:06:10.571Z"}, "title": "jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "type": "CWE"}]}], "affected": [{"vendor": "FasterXML", "product": "jackson-core", "collectionURL": "https://repo1.maven.org/maven2", "packageName": "com.fasterxml.jackson.core:jackson-core", "repo": "https://github.com/FasterXML/jackson-core", "programRoutines": [{"name": "com.fasterxml.jackson.core.json.UTF8DataInputJsonParser._reportInvalidToken"}], "versions": [{"status": "affected", "version": "2.8.0", "lessThanOrEqual": "2.18.10", "versionType": "maven"}, {"status": "affected", "version": "2.19.0", "lessThanOrEqual": "2.21.6", "versionType": "maven"}, {"status": "affected", "version": "2.22.0", "lessThanOrEqual": "2.22.2", "versionType": "maven"}], "defaultStatus": "unaffected"}, {"vendor": "FasterXML", "product": "jackson-core", "collectionURL": "https://repo1.maven.org/maven2", "packageName": "tools.jackson.core:jackson-core", "repo": "https://github.com/FasterXML/jackson-core", "programRoutines": [{"name": "tools.jackson.core.json.UTF8DataInputJsonParser._reportInvalidToken"}], "versions": [{"status": "affected", "version": "3.0.0", "lessThanOrEqual": "3.1.6", "versionType": "maven"}, {"status": "affected", "version": "3.2.0", "lessThanOrEqual": "3.2.2", "versionType": "maven"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.</p>"}]}], "references": [{"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf", "name": "GHSA-7hhh-6rmp-j9qf", "tags": ["vendor-advisory"]}, {"url": "https://github.com/FasterXML/jackson-core/pull/1698", "name": "FasterXML/jackson-core#1698", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "workarounds": [{"lang": "en", "value": "No StreamReadConstraints or ErrorReportConfiguration setting mitigates this issue on the affected code path. Where possible, avoid JsonFactory.createParser(DataInput) for attacker-supplied content and use createParser(InputStream), createParser(Reader) or a byte-array overload instead; those parser implementations enforce maxErrorTokenLength correctly. Otherwise, bound input size ahead of the parser and cap JVM heap so that a single request cannot exhaust process memory.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>No StreamReadConstraints or ErrorReportConfiguration setting mitigates this issue on the affected code path. Where possible, avoid JsonFactory.createParser(DataInput) for attacker-supplied content and use createParser(InputStream), createParser(Reader) or a byte-array overload instead; those parser implementations enforce maxErrorTokenLength correctly. Otherwise, bound input size ahead of the parser and cap JVM heap so that a single request cannot exhaust process memory.</p>"}]}], "solutions": [{"lang": "en", "value": "Upgrade to com.fasterxml.jackson.core:jackson-core 2.18.11, 2.21.7 or 2.22.3, or to tools.jackson.core:jackson-core 3.1.7 or 3.2.3. The 2.8.x through 2.17.x, 2.19.x, 2.20.x and 3.0.x lines received no fix on their own branch and are no longer maintained upstream; consumers of those lines must move forward to a maintained release.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade to com.fasterxml.jackson.core:jackson-core 2.18.11, 2.21.7 or 2.22.3, or to tools.jackson.core:jackson-core 3.1.7 or 3.2.3. The 2.8.x through 2.17.x, 2.19.x, 2.20.x and 3.0.x lines received no fix on their own branch and are no longer maintained upstream; consumers of those lines must move forward to a maintained release.</p>"}]}], "credits": [{"lang": "en", "value": "manqingzhou", "type": "finder"}]}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo1.maven.org/maven2", "defaultStatus": "unaffected", "packageName": "com.fasterxml.jackson.core:jackson-core", "product": "jackson-core", "programRoutines": [{"name": "com.fasterxml.jackson.core.json.UTF8DataInputJsonParser._reportInvalidToken"}], "repo": "https://github.com/FasterXML/jackson-core", "vendor": "FasterXML", "versions": [{"lessThanOrEqual": "2.18.10", "status": "affected", "version": "2.8.0", "versionType": "maven"}, {"lessThanOrEqual": "2.21.6", "status": "affected", "version": "2.19.0", "versionType": "maven"}, {"lessThanOrEqual": "2.22.2", "status": "affected", "version": "2.22.0", "versionType": "maven"}]}, {"collectionURL": "https://repo1.maven.org/maven2", "defaultStatus": "unaffected", "packageName": "tools.jackson.core:jackson-core", "product": "jackson-core", "programRoutines": [{"name": "tools.jackson.core.json.UTF8DataInputJsonParser._reportInvalidToken"}], "repo": "https://github.com/FasterXML/jackson-core", "vendor": "FasterXML", "versions": [{"lessThanOrEqual": "3.1.6", "status": "affected", "version": "3.0.0", "versionType": "maven"}, {"lessThanOrEqual": "3.2.2", "status": "affected", "version": "3.2.0", "versionType": "maven"}]}], "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}], "id": "CVE-2026-89425", "lastModified": "2026-09-23T03:17:04.357", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "36c7be3b-2937-45df-85ea-ca7133ea542c", "type": "Secondary"}]}, "published": "2026-09-23T03:17:04.357", "references": [{"source": "36c7be3b-2937-45df-85ea-ca7133ea542c", "url": "https://github.com/FasterXML/jackson-core/pull/1698"}, {"source": "36c7be3b-2937-45df-85ea-ca7133ea542c", "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"}], "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "36c7be3b-2937-45df-85ea-ca7133ea542c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.8.0,2.18.10]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.19.0,2.21.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.22.0,2.22.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "jackson-core", "source": "cna", "vendor": "FasterXML"}, "product": "jackson-core", "vendor": "fasterxml"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.1.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.2.0,3.2.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "jackson-core", "source": "cna", "vendor": "FasterXML"}, "product": "jackson-core", "vendor": "fasterxml"}], "created": "2026-09-23T03:30:17.295244+00:00", "updated": "2026-09-23T03:30:17.295276+00:00", "vendors": ["fasterxml", "fasterxml$PRODUCT$jackson-core"]}