{"id":"CVE-2026-68498","kind":"vulnerability","aliases":["CVE-2026-68498"],"related":[],"title":"Jackson core: oversized JSON property names bypass memory limit when parsing text","description":"StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.\n\n\n\nIn the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.\n\n\n\nA remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.\n\n\n\nByte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.","summary":"jackson-core parsers built over String, Reader or char[] input do not enforce the maxNameLength limit while accumulating a JSON property name, so the check only runs after the name is fully buffered. An attacker who sends a very long property name can force roughly 200 MB of allocation per parse, which can exhaust heap and crash the process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jackson","java","jvm-services","package","rest-api","spring-boot"],"not_affected_if":["byte-input-parsing","jackson-before-2.16.0","no-untrusted-json"],"how_to_check":"- Check the jackson-core version in the build file or lockfile (`mvn dependency:tree | grep jackson-core` or `gradle dependencies`); affected versions are 2.16.0 and later in the 2.x line and 3.0.0 and later in tools.jackson.core.\n- Find code that calls ObjectMapper.readValue or JsonParser on a String, Reader or char[] built from untrusted request bodies.\n- Confirm whether StreamReadConstraints has been customized; the default maxNameLength is 50,000 characters.","fix":"- Upgrade com.fasterxml.jackson.core:jackson-core to a release that validates name length on the character-input path; the fixed version is unknown from the sources.\n- Upgrade tools.jackson.core:jackson-core to the fixed 3.x release; the version is unknown from the sources.\n- Until patched, parse untrusted input as UTF-8 bytes (InputStream or byte[]) rather than String or Reader, since byte-input parsers reject oversized names early.","status":"open","published_at":"2026-10-16T22:17:25+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:24:53+00:00","updated_at":"2026-10-25T03:24:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:24:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade com.fasterxml.jackson.core:jackson-core to a release that validates name length on the character-input path; the fixed version is unknown from the sources.\n- Upgrade tools.jackson.core:jackson-core to the fixed 3.x release; the version is unknown from the sources.\n- Until patched, parse untrusted input as UTF-8 bytes (InputStream or byte[]) rather than String or Reader, since byte-input parsers reject oversized names early.","reach":"internet","title":"Jackson core: oversized JSON property names bypass memory limit when parsing text","impact":"medium","summary":"jackson-core parsers built over String, Reader or char[] input do not enforce the maxNameLength limit while accumulating a JSON property name, so the check only runs after the name is fully buffered. An attacker who sends a very long property name can force roughly 200 MB of allocation per parse, which can exhaust heap and crash the process.","category":"package","nicknames":[],"who_cares":["java","jackson","spring-boot","rest-api","jvm-services"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote requests can exhaust heap memory and crash the Java process","analyst_note":"Find the fixed jackson-core versions for both 2.x and 3.x lines from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-68498 and the upstream jackson-core release notes.","how_to_check":"- Check the jackson-core version in the build file or lockfile (`mvn dependency:tree | grep jackson-core` or `gradle dependencies`); affected versions are 2.16.0 and later in the 2.x line and 3.0.0 and later in tools.jackson.core.\n- Find code that calls ObjectMapper.readValue or JsonParser on a String, Reader or char[] built from untrusted request bodies.\n- Confirm whether StreamReadConstraints has been customized; the default maxNameLength is 50,000 characters.","needs_analyst":true,"not_affected_if":["byte-input-parsing","jackson-before-2.16.0","no-untrusted-json"],"who_is_affected":"Applications that parse untrusted JSON from String, Reader or char[] sources are exposed, for example an HTTP request body already read into a String. Byte-input parsing (UTF-8 streams or byte arrays) is not affected. Releases before 2.16.0 are not affected because maxNameLength was introduced in 2.16.0.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000851,"input_tokens":4080,"output_tokens":886,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':323C '-2026':14A,17A '-68498':15A,18A '-8':409C '000':94C,122C,123C,264C,265C,288C '100':121C,263C,291C '2.16.0':419C,429C,442C '200':77B,268C '2000x':172C '3.0.0':426C '50':93C,287C 'accumul':49B,155C,184C 'across':299C 'affect':344C,413C,432C 'afterward':208C 'alloc':80B,258C,374C 'alreadi':233C,399C 'api':27B,295C 'appli':149C 'applic':379C 'approxim':267C,286C 'async':352C 'attack':66B,240C 'authent':311C 'block':351C 'bodi':398C 'bookkeep':272C 'boot':30B 'bound':99C,126C,146C,293C,326C 'buffer':64B,235C,366C 'built':35B,132C 'bypass':7A 'byte':339C,410C 'byte-input':338C 'call':195C 'char':40B,139C,392C 'charact':95C,124C,134C,179C,231C,266C,289C 'character-input':178C 'charstonamecanonicalizer.findsymbol':210C 'check':56B,168C,203C 'close':220C 'code':157C 'com.fasterxml.jackson.core':414C 'concurr':300C 'configur':337C 'consum':110C 'core':2A,33B,417C,424C,441C 'correct':202C 'crash':88B,307C 'cve':13A,16A 'decod':365C 'default':92C,120C,175C,322C,336C 'disabl':320C 'els':325C 'enforc':44B 'entir':213C 'everi':359C 'exampl':394C 'exhaust':85B,303C 'exploit':334C 'expos':381C 'fill':194C 'first':329C,436C 'forc':75B,257C 'full':226C 'fulli':63B 'growth':360C 'heap':86B,305C 'higher':277C 'http':396C 'independ':114C 'input':41B,135C,180C,340C 'instead':159C,283C 'int':205C 'intend':97C 'interact':314C 'introduc':437C 'issu':332C,412C 'jackson':1A,19B,32B,416C,423C,440C 'jackson-cor':31B,415C,422C,439C 'java':20B 'json':4A,51B,105C,248C,384C 'jvm':22B 'jvm-servic':21B 'kb':292C 'kilobyt':378C 'larger':118C,173C 'length':167C 'limit':9A,47B 'long':71B,247C 'maxnamelength':46B,357C 'maxstringlength':119C,200C,230C 'mb':78B,269C 'memori':8A,102C,237C 'much':101C,117C 'name':6A,53B,61B,73B,108C,152C,186C,214C,227C,251C,364C,372C 'name-decod':363C 'non':350C 'non-block':349C 'noth':324C 'object':106C,249C 'order':261C 'ordinari':127C 'overs':3A,371C 'packag':24B 'pars':11A,82B,113C,252C,386C 'parser':34B,131C,341C,353C 'parserbase._grownamedecodebuffer':368C 'path':158C,182C,255C 'peak':275C 'per':81B 'point':224C 'process':90B,309C 'promis':296C 'properti':5A,52B,72B,107C,250C 'push':273C 'quot':221C 'rather':404C 'raw':407C 're':161C,355C 're-us':160C 're-valid':354C 'reach':207C 'read':400C 'reader':38B,136C,390C 'readerbasedjsonpars':144C 'readerbasedjsonparser._parsename2':183C 'real':274C 'reject':369C 'releas':427C 'remot':239C 'repeat':297C 'request':301C,397C 'requir':316C 'rest':26B 'rest-api':25B 'rough':76B,171C 'run':58B 'scan':217C 'segment':193C,271C 'send':68B 'serv':142C 'servic':23B 'singl':104C,245C 'slow':181C 'sourc':140C 'spring':29B 'spring-boot':28B 'streamconstraintsexcept':280C 'streamreadconstraints.maxdocumentlength':318C 'streamreadconstraints.maxnamelength':91C,434C 'streamreadconstraints.validatenamelength':204C 'string':37B,128C,137C,165C,389C,403C 'string-valu':164C 'suffici':246C 'ten':376C 'text':12A 'textbuff':189C 'textbuffer.finishcurrentsegment':196C 'thrown':282C 'token':328C 'tools.jackson.core':421C 'untrust':383C 'usag':276C 'use':162C 'user':313C 'utf':408C 'utf8datainputjsonparser':346C 'utf8streamjsonparser':345C 'valid':198C,356C 'valu':129C,166C 'via':367C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse untrusted JSON from String, Reader or char[] sources are exposed, for example an HTTP request body already read into a String. Byte-input parsing (UTF-8 streams or byte arrays) is not affected. Releases before 2.16.0 are not affected because maxNameLength was introduced in 2.16.0.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T22:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"36c7be3b-2937-45df-85ea-ca7133ea542c","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68498","severity":null,"published_at":"2026-10-16T22:17:25+00:00","modified_at":"2026-10-20T19:17:40+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}