CVE-2026-89425: jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-23 · updated 2026-09-24
Weakness: CWE-400

Description

UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Affected products

Maven Com.Fasterxml.Jackson.Core:Jackson-Core: from 2.19.0 before 2.21.7; from 2.22.0 before 2.22.3; from 2.8.0 before 2.18.11; 2.19.0, 2.19.1, 2.19.2, 2.19.3, 2.19.4, 2.20.0 (+110) — fixed in 2.21.7, 2.22.3, 2.18.11
Maven Tools.Jackson.Core:Jackson-Core: from 3.0.0 before 3.1.7; from 3.2.0 before 3.2.3; 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.0 (+10) — fixed in 3.1.7, 3.2.3
FasterXML jackson-core: from 2.8.0 through 2.18.10; from 2.19.0 through 2.21.6; from 2.22.0 through 2.22.2; from 3.0.0 through 3.1.6; from 3.2.0 through 3.2.2

How to fix

Upgrade to a fixed version: Maven Com.Fasterxml.Jackson.Core:Jackson-Core 2.21.7, 2.22.3, 2.18.11; Maven Tools.Jackson.Core:Jackson-Core 3.1.7, 3.2.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-89425 or the next vulnerability affects your stack