Allocation of Resources Without Limits or Throttling in com.fasterxml.jackson.core:jackson-core

Summary

The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq] (Number Length Constraint Bypass in Async Parser, published 2026-02-28) is incomplete. The fix commit `b0c428e6` (#1555) wired `validateIntegerLength` into a new `_setIntLength` helper and called it at every place where the integer portion of a number is *decided* (terminator byte arrived, `.` / `e/E` seen, end-of-feed inside a fully-buffered value). It did not call it on the much more attacker-relevant path: "ran out of input while still inside `MINOR_NUMBER_INTEGER_DIGITS`, return `NOT_AVAILABLE` to caller". All versions prior to 2.18.8, 2.19.x prior to 2.21.4 and 2.22.x prior to 2.22.1 are affected. The package "tools.jackson.core:jackson-core" is also affected in versions prior to 3.1.4 and 3.2.x prior to 3.2.1.