CVE-2026-1037: IBM Common Licensing vulnerability
The non-blocking (async) JSON parser in jackson-core bypasses the maxNumberLength constraint (default: 1000 characters) defined in StreamReadConstraints. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS). The standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy. WS-2026-0003 was later assigned CVE-2026-18401.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using jackson-core's non-blocking (async) JSON parser API are exposed. The standard synchronous parser enforces the maximum number length and is not affected by this bypass.
What must an attacker be able to do to exploit it?
An attacker must be able to submit JSON to a code path that processes it with the async parser. They can use arbitrarily long numeric values to drive excessive memory allocation and CPU consumption, causing denial of service.
Are default settings sufficient to prevent the issue?
No. The default StreamReadConstraints maxNumberLength is 1000 characters, but the async parser bypasses that constraint.