Uncontrolled resource consumption in FasterXML jackson-core
Priority HIGH 72CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 24 fixed, 27 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00532 45th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-core (Maven): 2.21.7, 2.22.3, 2.18.11tools.jackson.core:jackson-core (Maven): 3.1.7, 3.2.3Red Hat: 23 advisoriesRed Hat: 24 fixed, 27 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FasterXML | jackson-core | 2.8.0 – 2.18.10; 2.19.0 – 2.21.6; 2.22.0 – 2.22.2 | — | No fix listed | CNA |
| FasterXML | jackson-core | 3.0.0 – 3.1.6; 3.2.0 – 3.2.2 | — | No fix listed | CNA |
| — | com.fasterxml.jackson.core:jackson-core (Maven) | 2.19.0 to before 2.21.7 | 2.21.7 | Patch available | GHSA-7hhh-6rmp-j9qf |
| — | com.fasterxml.jackson.core:jackson-core (Maven) | 2.22.0 to before 2.22.3 | 2.22.3 | Patch available | GHSA-7hhh-6rmp-j9qf |
| — | tools.jackson.core:jackson-core (Maven) | 3.0.0 to before 3.1.7 | 3.1.7 | Patch available | GHSA-7hhh-6rmp-j9qf |
| — | tools.jackson.core:jackson-core (Maven) | 3.2.0 to before 3.2.3 | 3.2.3 | Patch available | GHSA-7hhh-6rmp-j9qf |
| — | com.fasterxml.jackson.core:jackson-core (Maven) | 2.8.0 to before 2.18.11 | 2.18.11 | Patch available | GHSA-7hhh-6rmp-j9qf |
- jackson-core VendorFasterXML Affected 2.8.0 – 2.18.10; 2.19.0 – 2.21.6; 2.22.0 – 2.22.2 Fixed in — No fix listed CNA
- jackson-core VendorFasterXML Affected 3.0.0 – 3.1.6; 3.2.0 – 3.2.2 Fixed in — No fix listed CNA
- com.fasterxml.jackson.core:jackson-core (Maven) Vendor— Affected 2.19.0 to before 2.21.7 Fixed in 2.21.7 Patch available GHSA-7hhh-6rmp-j9qf
- com.fasterxml.jackson.core:jackson-core (Maven) Vendor— Affected 2.22.0 to before 2.22.3 Fixed in 2.22.3 Patch available GHSA-7hhh-6rmp-j9qf
- tools.jackson.core:jackson-core (Maven) Vendor— Affected 3.0.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-7hhh-6rmp-j9qf
- tools.jackson.core:jackson-core (Maven) Vendor— Affected 3.2.0 to before 3.2.3 Fixed in 3.2.3 Patch available GHSA-7hhh-6rmp-j9qf
- com.fasterxml.jackson.core:jackson-core (Maven) Vendor— Affected 2.8.0 to before 2.18.11 Fixed in 2.18.11 Patch available GHSA-7hhh-6rmp-j9qf
Remediation
- Fix · GHSA-7hhh-6rmp-j9qf com.fasterxml.jackson.core:jackson-core (Maven) Fixed in 2.21.7 Advisory →
- Fix · GHSA-7hhh-6rmp-j9qf com.fasterxml.jackson.core:jackson-core (Maven) Fixed in 2.22.3 Advisory →
- Fix · GHSA-7hhh-6rmp-j9qf tools.jackson.core:jackson-core (Maven) Fixed in 3.1.7 Advisory →
- Fix · GHSA-7hhh-6rmp-j9qf tools.jackson.core:jackson-core (Maven) Fixed in 3.2.3 Advisory →
- Fix · GHSA-7hhh-6rmp-j9qf com.fasterxml.jackson.core:jackson-core (Maven) Fixed in 2.18.11 Advisory →
Red Hat 23 advisories
- RHSA-2026:92859 Released 2026-10-29 · Red Hat rating ImportantSatellite 6.17 security update
- Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
- RHSA-2026:92861 Released 2026-10-29 · Red Hat rating CriticalSatellite 6.19 security update
- Red Hat Satellite 6.19 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, python3.12-brotli-1.2.1-1.el9pc +6
- RHSA-2026:92858 Released 2026-10-29 · Red Hat rating ImportantSatellite 6.16 EUS security update
- Red Hat Satellite 6.16 for RHEL 8 openvox-agent-8.31.1-1.el8sat, openvox-server-8.17.0-1.el8sat, yggdrasil-worker-forwarder-0.1.1-1.el8sat
- Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
Show 20 more Red Hat advisories
- RHSA-2026:92860 Released 2026-10-29 · Red Hat rating ImportantSatellite 6.18 security update
- Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
- RHSA-2026:90909 Released 2026-10-27 · Red Hat rating Importantpki-deps:10.6 security update
- Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.10.0+20993+d0f024b0.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.10.0+20993+d0f024b0.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.10.0+20993+d0f024b0.noarch::pki-deps:10.6 +47
- RHSA-2026:88159 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
- OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88158 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
- OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88157 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
- OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88156 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
- OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88155 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
- OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88154 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
- OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88153 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
- OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88151 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
- OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88152 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
- OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88149 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
- OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88150 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
- OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:86891 Released 2026-10-21 · Red Hat rating CriticalRHOAI 3.5.2 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
- RHSA-2026:86706 Released 2026-10-21 · Red Hat rating Moderatejackson-core security update
- Red Hat Enterprise Linux AppStream (v. 9) jackson-core-2.21.6-1.el9_8.2, pki-jackson-core-2.21.6-1.el9_8.2
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:83670 Released 2026-10-15 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.GA)
- Red Hat Build of Apache Camel 3.33.4.redhat com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar, io.micrometer.micrometer-core-1.16.7.redhat-00002.jar +14
- RHSA-2026:83520 Released 2026-10-15 · Red Hat rating ImportantRed Hat build of Quarkus 3.33.4 release and security update
- Red Hat build of Quarkus 3.33.4.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +10
- RHSA-2026:83082 Released 2026-10-15 · Red Hat rating ImportantRed Hat build of Quarkus 3.27.6 release and security update
- Red Hat build of Quarkus 3.27.6.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +11
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix planned: Will not fix |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Build of Keycloak | Affected | No fix yet |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certificate System 10 | Affected | No fix yet |
| Red Hat Certificate System 11 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet |
| Red Hat JBoss Web Server 7 | Affected | No fix yet |
| Red Hat Lightspeed for Runtimes Operator | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Red Hat build of Debezium 3 | Affected | No fix yet |
| OpenShift Developer Tools and Services 4.12 | Fixed | RHSA-2026:88152 |
| OpenShift Developer Tools and Services 4.13 | Fixed | RHSA-2026:88149 |
| OpenShift Developer Tools and Services 4.14 | Fixed | RHSA-2026:88151 |
| OpenShift Developer Tools and Services 4.15 | Fixed | RHSA-2026:88150 |
| OpenShift Developer Tools and Services 4.16 | Fixed | RHSA-2026:88156 |
| OpenShift Developer Tools and Services 4.17 | Fixed | RHSA-2026:88159 |
| OpenShift Developer Tools and Services 4.18 | Fixed | RHSA-2026:88153 |
| OpenShift Developer Tools and Services 4.19 | Fixed | RHSA-2026:88158 |
| OpenShift Developer Tools and Services 4.20 | Fixed | RHSA-2026:88157 |
| OpenShift Developer Tools and Services 4.21 | Fixed | RHSA-2026:88155 |
| OpenShift Developer Tools and Services 4.22 | Fixed | RHSA-2026:88154 |
| Red Hat Build of Apache Camel 3.33.4.redhat | Fixed | RHSA-2026:83670 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:90909 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:86706 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:87410 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
| Red Hat OpenShift AI 3.5 | Fixed | RHSA-2026:86891 |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2026:92858 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2026:92858 |
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2026:92859 |
| Red Hat Satellite 6.18 for RHEL 9 | Fixed | RHSA-2026:92860 |
| Red Hat Satellite 6.19 for RHEL 9 | Fixed | RHSA-2026:92861 |
| Red Hat build of Quarkus 3.27.6.redhat | Fixed | RHSA-2026:83082 |
| Red Hat build of Quarkus 3.33.4.redhat | Fixed | RHSA-2026:83520 |
Not affected: 32 products
- OpenShift Developer Tools and Services 4.12
- OpenShift Developer Tools and Services 4.13
- OpenShift Developer Tools and Services 4.14
- OpenShift Developer Tools and Services 4.15
- OpenShift Developer Tools and Services 4.16
- OpenShift Developer Tools and Services 4.17
- OpenShift Developer Tools and Services 4.18
- OpenShift Developer Tools and Services 4.19
- OpenShift Developer Tools and Services 4.20
- OpenShift Developer Tools and Services 4.21
- OpenShift Developer Tools and Services 4.22
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Apache Camel 3.33.4.redhat
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat Hardened Images
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Offline Knowledge Portal
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift AI 3.5
- Red Hat OpenStack Platform 16.2
- Red Hat Satellite 6
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Red Hat Satellite 6.17 for RHEL 9
- Red Hat Satellite 6.18 for RHEL 9
- Red Hat Satellite 6.19 for RHEL 9
- Red Hat build of Quarkus 3.27.6.redhat
- Red Hat build of Quarkus 3.33.4.redhat
Timeline
- 2026-10-02 Threatist record created from CVE-2026-89425
- 2026-10-03 Alias added: GHSA-7hhh-6rmp-j9qf
- 2026-10-07 Affected versions changed · Red Hat
- 2026-10-08 Affected versions changed · Red Hat
- 2026-10-13 Affected versions changed · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83520 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83082 · Red Hat
- 2026-10-16 Fix available: Red Hat build of Quarkus 3.27.6.redhat, Red Hat build of Quarkus 3.33.4.redhat · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-21 Fix available: RHSA-2026:86706 · Red Hat
- 2026-10-21 Fix available: Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
- 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
- 2026-10-29 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +15 · Red Hat
- 2026-10-29 CVSS score added · Red Hat
- 2026-10-29 Fix available: RHSA-2026:90909 · Red Hat
- 2026-10-29 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92858 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92859 · Red Hat
- 2026-10-30 Fix available: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9 +1 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92860 · Red Hat
- 2026-10-30 Fix available: Red Hat Satellite 6.19 for RHEL 9 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92861 · Red Hat
- 2026-11-06 Fix available: Red Hat Build of Apache Camel 3.33.4.redhat · Red Hat
- 2026-11-06 Fix available: RHSA-2026:83670 · Red Hat
References
Patch 1
More FasterXML vulnerabilities
- TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
- TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
- TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
- TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
- TI-2026-60468 jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS CVSS 3.1HIGH 7.5
Sources
- CVE-2026-89425 · CVE Program
- CVE-2026-89425 · NVD
- FIRST EPSS
- GHSA-7hhh-6rmp-j9qf · GitHub Advisory Database · CC BY 4.0
- CVE-2026-89425 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences