CVE-2026-18401 FasterXML CVE debrief

Who should care

Defenders of applications using the async parser API in jackson-core should assess exposure and prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks.

Why it matters

Defenders should care about CVE-2026-18401 because it is a denial-of-service vulnerability in the non-blocking JSON parser in jackson-core. An attacker can submit a JSON document with an arbitrarily long number to cause excessive memory allocation and potential CPU exhaustion. The async parser API does not enforce the maxNumberLength constraint, unlike the synchronous parser. Defenders of applications using the async parser API should assess exposure and prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks.

• Denial of service through excessive memory allocation
• Potential CPU exhaustion through O(n^2) BigInteger parsing
• Verification of maxNumberLength constraint enforcement in async parser API
• Patching or mitigating the vulnerability to prevent denial-of-service attacks

Technical summary

The non-blocking JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints. An attacker can submit a JSON document with an arbitrarily long number to cause excessive memory allocation and potential CPU exhaustion, resulting in a denial of service. The async parser API in jackson-core does not enforce this constraint, unlike the synchronous parser. This inconsistency can lead to denial-of-service attacks if an attacker sends a JSON document containing an arbitrarily long number to an application using the async parser. The root cause of this issue is that the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in applications using the async parser API, to prevent potential denial-of-service attacks.

Recommended defensive actions

• Patch jackson-core to a version that enforces the maxNumberLength constraint in the async parser API
• Mitigate the vulnerability by limiting the length of JSON input
• Monitor applications using the async parser API for potential denial-of-service attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its description, impact, and affected versions. The async parser API in jackson-core does not enforce the maxNumberLength constraint, allowing an attacker to submit a JSON document with an arbitrarily long number.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.