PatchTheCVECVE-2026-18401: The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint de
38
Routine
MEDIUM 6.9REMOTE
CVE-2026-18401 is a medium-severity flaw (CVSS 6.9) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service. The synchronous parser enforces this limit corr
Why this priority
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 6.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 66%) |
| CISA exploited list | No |
| Weakness | CWE-770 |
| Published | 2026-08-04 |
| Last modified | 2026-10-23 |
Publisher (CNA): HeroDevs
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.