{"uuid": "87c97aa3-1215-44b6-85ce-76a90ca8b3fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-R7WM-3CXJ-WFF9", "type": "seen", "source": "https://gist.github.com/alon710/a699a0ff594951c1548ee266a0f2d1af", "content": "# GHSA-R7WM-3CXJ-WFF9: GHSA-R7WM-3CXJ-WFF9: StreamReadConstraints Bypass in jackson-core Async Parser\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-07-21\n> **Full Report:** https://cvereports.com/reports/GHSA-R7WM-3CXJ-WFF9\n\n## Summary\nA critical validation bypass exists in FasterXML jackson-core due to an incomplete fix for GHSA-72hv-8253-57qq. When parsing JSON asynchronously using NonBlockingUtf8JsonParserBase, the StreamReadConstraints.maxNumberLength constraint is bypassed when numeric inputs are received in small, non-terminating chunks. The parser continually accumulates digit-only input in an internal buffer without triggering validation constraints, resulting in potential heap memory exhaustion and application-level Denial of Service.\n\n## TL;DR\nAn incomplete security fix in Jackson-core allows remote attackers to bypass numeric length limits via slow-drip asynchronous JSON streaming, causing memory exhaustion and Denial of Service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS**: 5.3\n- **EPSS Score**: N/A\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing FasterXML jackson-core async parsing on WebFlux/Netty/Vert.x infrastructure\n- **jackson-core (Maven Standard)**: >= 2.18.6, < 2.19.2 (Fixed in: `2.19.2`)\n- **jackson-core (Maven Standard)**: >= 2.20.0, < 2.21.1 (Fixed in: `2.21.1`)\n- **jackson-core (Maven Tools)**: >= 3.0.0, < 3.1.0 (Fixed in: `3.1.0`)\n\n## Mitigation\n\n- Upgrade jackson-core dependencies to patched releases\n- Enforce maximum string length limits in StreamReadConstraints\n- Deploy reverse-proxy rate limiting to prevent slow-drip streaming attacks\n\n**Remediation Steps:**\n1. Update maven or gradle build configuration to use com.fasterxml.jackson.core:jackson-core version 2.19.2, 2.21.1 or later\n2. Configure StreamReadConstraints builder to explicitly drop maxStringLength to limit total worst-case allocation per stream\n3. Configure web gateway timeouts and minimum data rate checks to terminate slow-drip client connections\n\n## References\n\n- [GHSA-R7WM-3CXJ-WFF9 Advisory Page](https://github.com/advisories/GHSA-R7WM-3CXJ-WFF9)\n- [Parent Security Advisory GHSA-72hv-8253-57qq](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq)\n- [Jackson Core Main Project Repository](https://github.com/FasterXML/jackson-core)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-R7WM-3CXJ-WFF9) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-22T09:31:57.364966Z"}