CVE-2026-89425
Received Received - Intake

Unbounded StringBuilder Growth in FasterXML Jackson-core

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: HeroDevs

Description
UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-89425
EUVD
EUVD-2026-85000

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
fasterxml jackson-core From 2.8.0 (inc) to 2.18.11 (exc)
fasterxml jackson-core From 2.19.0 (inc) to 2.21.7 (exc)
fasterxml jackson-core From 2.22.0 (inc) to 2.22.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Jackson-core library's UTF8DataInputJsonParser. When processing malformed JSON tokens via DataInput, it builds error messages by appending all characters of the token to a StringBuilder without any length limit. This causes unbounded memory growth, leading to potential OutOfMemoryError and denial-of-service conditions.

Detection Guidance

To detect this vulnerability, monitor for unusually large error messages or OutOfMemoryError exceptions when processing JSON input via Jackson-core's DataInput parser. Check application logs for exceptions containing very long token strings. Use tools like Wireshark to inspect network traffic for malformed JSON payloads targeting Jackson parsers.

Impact Analysis

An attacker could send maliciously crafted JSON data to trigger this flaw, causing excessive memory consumption and crashing the application with an OutOfMemoryError. This disrupts service availability and may expose system resources through large error messages.

Mitigation Strategies

Upgrade Jackson-core to version 2.8.11 or later. If upgrading is not immediately possible, restrict access to the JsonFactory.createParser(DataInput) API or implement input size limits at the network/application layer. Monitor for DoS conditions and ensure sufficient memory allocation for error handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89425. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart