CVE-2026-89425

About vulnerability

UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Affected product:

AlmaLinux 9.2 ESU , Apache CXF , Apache Hadoop , Apache Hive , Apache Kafka , Apache Log4j , Apache Maven , Apache Solr , Apache Spark , Apache Struts , Eclipse Jersey , Eclipse Jetty , Elasticsearch , Hazelcast , Hibernate , Jackson , OpenSearch , Spring , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Wildfly , accumulo , activemq , agepredictor , airlift , alluxio , amazon-kinesis-client , amazon-kinesis-producer , apicurio-common-rest-client , apicurio-registry , apicurio-registry-operator , archaius , ardielle-java , arrow , artemis , athenz , avro , aws-glue-schema-registry , aws-java-sdk-appmesh , aws-java-sdk-autoscalingplans , aws-java-sdk-budgets , aws-java-sdk-cloudhsm , aws-java-sdk-cloudwatchmetrics , aws-java-sdk-cognitosync , aws-java-sdk-comprehendmedical , aws-java-sdk-datasync , aws-java-sdk-devicefarm , aws-java-sdk-dms , aws-java-sdk-globalaccelerator , aws-java-sdk-importexport , aws-java-sdk-iotanalytics , aws-java-sdk-marketplaceentitlement , aws-java-sdk-mechanicalturkrequester , aws-java-sdk-opsworkscm , aws-java-sdk-pinpoint , aws-java-sdk-quicksight , aws-java-sdk-resourcegroups , aws-java-sdk-robomaker , aws-java-sdk-shield , aws-java-sdk-workdocs , aws-java-sdk-xray , aws-sdk-java , aws-sdk-java-v2 , aws-secretsmanager-caching-java , aws-secretsmanager-jdbc , aws-xray-sdk-java , azure-cosmosdb-java , azure-data-lake-store-sdk , azure-kusto-java , azure-sdk-for-java , azure-search-documents , azure-spring-data-cosmos , azure-storage-java , bookkeeper , braintree_java , bytebuffer-collections , calcite , camel , canal , carrot2 , cassandra-java-driver , client_java , com.amazonaws:aws-java-sdk-appintegrations , com.amazonaws:aws-java-sdk-chimesdkmediapipelines , com.amazonaws:aws-java-sdk-codestarnotifications , com.amazonaws:aws-java-sdk-drs , com.amazonaws:aws-java-sdk-ec2instanceconnect , com.amazonaws:aws-java-sdk-iotdeviceadvisor , com.amazonaws:aws-java-sdk-lookoutmetrics , com.amazonaws:aws-java-sdk-mediapackagevod , com.amazonaws:aws-java-sdk-migrationhubrefactorspaces , com.amazonaws:aws-java-sdk-outposts , com.amazonaws:aws-java-sdk-ssoadmin , com.amazonaws:aws-java-sdk-textract , com.azure:azure-core-amqp , com.azure:azure-core-serializer-json-jackson , com.github.jsonld-java:jsonld-java , com.google.cloud.bigdataoss:gcsio , com.google.cloud.bigdataoss:util-hadoop , com.orientechnologies:orientdb-core , com.wavefront:wavefront-sdk-java , consul-client , corda , cos-java-sdk-v5 , cos-java-sdk-v5-bundle , couchbase-jvm-clients , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , curator , debezium , discovery , docker-java , docx4j , docx4j-ImportXHTML , docx4j-export-FO , droolsjbpm-integration , dropbox-sdk-java , druid , dynamodb-streams-kinesis-adapter , emitter , esri-geometry-api , etcd4j , eureka , fabric8 , fast-serialization , flink , flume , geode , geode-lucene , geoip2 , glassfish-hk2 , google-api-java-client , google-api-java-client-services , google-api-services-drive , google-auth-library-java , google-cloud-java , google-cloud-nio , google-http-java-client , google-oauth-java-client , grails-async , grails-core , grails-data-mapping , grails-gsp , grails-plugin-converters , graphql-java-servlet , groovy , grpc-java , hapi-fhir , hbase , hbase-thirdparty , http-client , huaweicloud-sdk-java-obs , hystrix , ignite , incubator-retired-htrace , incubator-retired-slider , infinispan , io.airlift:jmx , io.airlift:jmx-http , io.apicurio:apicurio-common-rest-client-jdk , io.quarkus:quarkus-credentials-deployment , io.quarkus:quarkus-datasource-deployment-spi , io.quarkus:quarkus-resteasy , io.vertx:vertx-codegen , jasperreports , java-apns , java-cas-client , java-couchbase-encryption , java-datastore , java-driver , java-genai , java-jwt , java-logging , java-opensaml , java-sdk , java-storage , java-util , jena , jersey , jetcd , jgroups-aws , jgroups-azure , jjwt , jolt , json-flattener , json-patch , json-schema-core , json-schema-validator , json4s , jsonpath , jsonschema-generator , jsonschema2pojo , jsonsurfer , jwks-rsa-java , karaf , kinesis-logback-appender , kite , kubernetes-client , logging-flume , logging-flume-irc , maxmind-db-reader-java , maxminddb , mbknor-jackson-jsonschema , mcp-annotations , metrics , micrometer , micrometer-tracing , micronaut-cache , micronaut-core , micronaut-spring , microsoft-authentication-library-for-java , mockwebserver , mustache.java , neo4j-ogm , olingo-odata4 , openai-java , opencensus-java , openstack4j , opentelemetry-java , opentelemetry-java-contrib , orc , org.apache.groovy:groovy-all , org.apache.jena:jena-tdb , org.apache.parquet:parquet-cli , org.kitesdk:kite-data-hbase , org.tachyonproject:tachyon-client , orientdb , parquet-java , pinecone-java-client , protostream , pulsar , pulsar-client-reactive , quarkus , redisson , remoting-jmx , rescu , rest-assured , resteasy , resteasy-spring , retrofit , ribbon , scribejava , sdk-platform-java , sentimentanalysisparser , server-metrics , signalfx-java , simulacron , smallrye-common , smallrye-mutiny-vertx-bindings , smallrye-open-api , smallrye-reactive-messaging , spectator , storm , strimzi-kafka-operator , swagger-core , swagger-parser , testcontainers-java , tika , tinkerpop , trendrrnsqclient , trino , twilio-java , typesense-java , vert.x , vertx-auth , vertx-eventbus-bridges , vertx-grpc , vertx-kafka-client , vertx-web , wavefront-internal-reporter-java , web3j , web3j-quorum , wiremock , ws-wss4j , xchange , ycsb , zendesk-java-client , zjsonpatch , zookeeper

Affected packages:

jackson-core @ 2.9.5 (+25899 more)