Skip to main content

Allocation of Resources Without Limits or Throttling in com.fasterxml.jackson.core:jackson-core

Cxfa47c4e4-5ef9

  • com.fasterxml.jackson.core:jackson-core
  • tools.jackson.core:jackson-core
High
8.7/10

Summary

The non-blocking (async) JSON parser in jackson-core bypasses the "maxNumberLength" constraint (default: 1000 characters) defined in "StreamReadConstraints". This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial-of-Service (DoS). Versions 3.x prior to 3.1.0, 2.19.x prior to 2.21.1, 2.0.x prior to 2.18.6 are affected. The standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy.

  • LOW
  • NETWORK
  • NONE
  • NONE

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published