Jackson-core CVE-770: Async parser maxNumberLength bypass causing OOM

Vulnerability Overview Vulnerability Name: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq) Vulnerability Description: In Jackson-core versions 2.18.6 and 2.21.1, the fix for GHSA-72hv-8253-57qq was incomplete. The fix introduced into the new helper and called it in every place to determine when the integer part of a number ends (terminator reached, seen, end-of-feed inside a fully-buffered value). However, it did not account for a much more attacker-relevant path: "ran out of input while still inside ", which returns to the caller. Consequently, an attacker can stream JSON to the non-blocking parser in very small chunks without sending terminator bytes, keeping the parser in indefinitely. grows with each chunk, and is never called. The accumulator is only limited by (20 MB by default), resulting in a ~20,000x amplification relative to (1000x amplification). Scope of Impact Affected Versions: Fixed Versions: Impact: Reactive frameworks (Spring WebFlux / Reactor, Quarkus, Helidon, Vert.x JSON, and any wrapper around or ) will exhaust memory when feeding inbound HTTP/RPC bytes to the asynchronous parser. Developers using assume this upper bound guarantees protection for each numeric value, but this guarantee does not hold in chunked feeding scenarios. The parser silently accumulates digits up to (20 MB by default) per concurrent connection. Multiplied by attacker-controlled concurrency, this can lead to an OutOfMemoryError (OOM) in the JVM. Synchronous parsers ( , ) and asynchronous parsers operating on complete input are unaffected, as these paths correctly route through or . CVE-770 (Allocation of Resources Without Limits or Throttling): CVSS score is approximately the same as the parent advisory (Network/Low Complexity/High Availability Impact). The parent advisory assigns a CVSS score of 8.7 (High). Remediation Recommended Fix: In , at every location returning (or ), call before calling when . Specifically, in , the method needs to add one line of code: Note: itself cannot be used directly because it also allocates , and must only be used once the integer is fully determined (subsequent fractional processing reads ). The minimal fix is to call the validator as shown. Apply the same single-line insertion at every location returning where . There are 12 such sites. Alternatively, a heavier refactoring: also call at within every number accumulation loop, so that the validator triggers immediately when the buffer needs expansion, rather than waiting for the next chunk boundary. Both approaches are sufficient. POC Code Observed Output Jackson-core 2.18.6: Jackson-core 2.21.1: Same. After Patch: Server-side Controller Trace Before Patch: ``` [ctrl] DataBuffer arrived size=0 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer arrived size=200 [ctrl] DataBuffer

Goal Reached Thanks to every supporter — we hit 100%!

Jackson-core CVE-770: Async parser maxNumberLength bypass causing OOM

More from this source