CVE-2026-89425
Description
UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.fasterxml.jackson.core:jackson-coreMaven | >= 2.19.0, < 2.21.7 | 2.21.7 |
com.fasterxml.jackson.core:jackson-coreMaven | >= 2.22.0, < 2.22.3 | 2.22.3 |
tools.jackson.core:jackson-coreMaven | >= 3.0.0, < 3.1.7 | 3.1.7 |
tools.jackson.core:jackson-coreMaven | >= 3.2.0, < 3.2.3 | 3.2.3 |
com.fasterxml.jackson.core:jackson-coreMaven | >= 2.8.0, < 2.18.11 | 2.18.11 |
Affected products
38- ghsa-coords37 versionspkg:maven/com.fasterxml.jackson.core/jackson-corepkg:maven/tools.jackson.core/jackson-corepkg:rpm/opensuse/jackson-databind&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/jackson-core&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/apache-commons-collectionspkg:rpm/almalinux/jackson-databindpkg:rpm/almalinux/jackson-jaxrs-json-providerpkg:rpm/almalinux/xsompkg:rpm/opensuse/jackson-core&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/apache-commons-langpkg:rpm/almalinux/glassfish-jaxb-corepkg:rpm/almalinux/glassfish-jaxb-runtimepkg:rpm/almalinux/glassfish-jaxb-txw2pkg:rpm/almalinux/jackson-annotationspkg:rpm/almalinux/jackson-corepkg:rpm/almalinux/jackson-jaxrs-providerspkg:rpm/almalinux/jackson-module-jaxb-annotationspkg:rpm/almalinux/jakarta-commons-httpclientpkg:rpm/almalinux/relaxngDatatypepkg:rpm/almalinux/stax-expkg:rpm/almalinux/velocitypkg:rpm/almalinux/xalan-j2pkg:rpm/almalinux/xml-commons-apispkg:rpm/almalinux/xml-commons-resolverpkg:rpm/almalinux/xmlstreambufferpkg:rpm/almalinux/pki-jackson-corepkg:rpm/almalinux/xerces-j2pkg:rpm/almalinux/apache-commons-netpkg:rpm/almalinux/bea-stax-apipkg:rpm/almalinux/glassfish-fastinfosetpkg:rpm/almalinux/glassfish-jaxb-apipkg:rpm/almalinux/javassistpkg:rpm/almalinux/javassist-javadocpkg:rpm/almalinux/pki-servlet-enginepkg:rpm/almalinux/slf4jpkg:rpm/almalinux/slf4j-jdk14pkg:rpm/opensuse/jackson-annotations&distro=openSUSE%20Leap%2016.0
>= 2.19.0, < 2.21.7+ 36 more
- (no CPE)range: >= 2.19.0, < 2.21.7
- (no CPE)range: >= 3.0.0, < 3.1.7
- (no CPE)range: < 2.18.11-160000.1.1
- (no CPE)range: < 2.18.11-160000.1.1
- (no CPE)range: < 3.2.2-10.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.21.4-1.module_el8.10.0+4329+908ad137.1
- (no CPE)range: < 2.21.4-1.module_el8.10.0+4235+0924958e
- (no CPE)range: < 0-19.20110809svn.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.18.11-1.1
- (no CPE)range: < 2.6-21.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.11-12.module_el8.10.0+3791+e0637953
- (no CPE)range: < 2.2.11-12.module_el8.10.0+3791+e0637953
- (no CPE)range: < 2.2.11-12.module_el8.10.0+3791+e0637953
- (no CPE)range: < 2.21-1.module_el8.10.0+4235+0924958e
- (no CPE)range: < 2.21.4-1.module_el8.10.0+4329+908ad137.3
- (no CPE)range: < 2.21.4-1.module_el8.10.0+4235+0924958e
- (no CPE)range: < 2.21.4-2.module_el8.10.0+4235+0924958e
- (no CPE)range: < 1:3.1-28.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2011.1-7.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7.7-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7-24.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.7.1-38.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.4.01-25.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.2-26.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.5.4-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.21.6-1.el9_8.2
- (no CPE)range: < 2.11.0-34.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 3.6-3.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.2.0-16.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.2.13-9.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.12-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 3.18.1-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 3.18.1-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1:9.0.62-1.module_el8.10.0+3791+e0637953
- (no CPE)range: < 1.7.25-4.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7.25-4.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.18.11-160000.1.1
- Range: >=2.8.0
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-7hhh-6rmp-j9qfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-89425ghsaADVISORY
- github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3ghsaWEB
- github.com/FasterXML/jackson-core/pull/1698nvdWEB
- github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11ghsaWEB
- github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3ghsaWEB
- github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qfnvdWEB
News mentions
0No linked articles in our index yet.