Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Jackson Core versions 3.0.0 up to but not including 3.1.1 (Maven tools.jackson.core:jackson-core) do not consistently enforce the StreamReadConstraints maxDocumentLength limit. Oversized JSON documents can be accepted without an error in blocking, async, and DataInput parsers, so an attacker sending untrusted JSON can bypass that size limit and drive up CPU and memory use. Upgrade to version 3.1.1, which is listed as the fixed version.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 1 Apr 2026, 21:50 UTC Published by the maintainers as a GitHub repository advisory
- 31 Oct 2026, 14:17 UTC First seen by agentprime
- 31 Oct 2026, 14:17 UTC Confirmed by OSV