CVE-2026-18401 FasterXML CVE debrief

Who should care

Defenders responsible for applications using the async parser API in jackson-core should assess exposure and prioritize verification and updates. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified. Defenders should also monitor for suspicious JSON submissions that could be used to exploit this vulnerability and track exceptions, retest remediated assets, and close the item only after evidence is

Why it matters

Defenders should care about CVE-2026-18401 because it allows an attacker to cause a denial-of-service in applications using the async parser API in jackson-core, potentially leading to excessive memory allocation and CPU exhaustion.

• Potential denial-of-service due to excessive memory allocation
• Potential CPU exhaustion due to O(n^2) BigInteger parsing
• Verification priority for applications using the async parser API
• Remediation priority for affected jackson-core versions

Technical summary

The non-blocking JSON parser in jackson-core does not enforce the maxNumberLength constraint, allowing an attacker to submit a JSON document with an arbitrarily long number to cause excessive memory allocation and potential CPU exhaustion. The root cause is that the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods. Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and validateFPLength() are

Defensive priority

Defenders should prioritize verifying and updating jackson-core versions to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify and update jackson-core versions to ensure the maxNumberLength constraint is enforced
• Review applications using the async parser API for potential exposure
• Monitor for suspicious JSON submissions that could be used to exploit this vulnerability
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, impact, and affected versions. The issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x. Versions prior to 2.15.0 are not affected because StreamReadConstraints was first introduced in jackson-core 2.15.0. The async parser API is used in applications like Spring WebFlux or other reactive

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.