---
id: CVE-2026-89425
title: >-
  UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds
  the offending-token text for its error message by appending Java identifier
  characters to a StringBuilder in a loop that has no upper bound
summary: >-
  UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds
  the offending-token text for its error message by appending Java identifier
  characters to a StringBuilder in a loop that has no upper bound. Unlike the
  three …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-770
  - CWE-1050
vendor: FasterXML
product: 'com.fasterxml.jackson.core:jackson-core'
affected:
  - 'com.fasterxml.jackson.core:jackson-core >= 2.8.0 <= 2.18.10'
  - 'com.fasterxml.jackson.core:jackson-core >= 2.19.0 <= 2.21.6'
  - 'com.fasterxml.jackson.core:jackson-core >= 2.22.0 <= 2.22.2'
  - 'tools.jackson.core:jackson-core >= 3.0.0 <= 3.1.6'
  - 'tools.jackson.core:jackson-core >= 3.2.0 <= 3.2.2'
published: '2026-09-23'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89425'
references:
  - url: 'https://github.com/FasterXML/jackson-core/pull/1698'
    label: 36c7be3b-2937-45df-85ea-ca7133ea542c
  - url: >-
      https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf
    label: 36c7be3b-2937-45df-85ea-ca7133ea542c
  - url: >-
      https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89425.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89425'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2539084'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89425'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89425'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
epss: 0.00492
epssPercentile: 0.39625
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-23T13:54:51.050132Z'
ingestedAt: '2026-09-23T03:16:01.007Z'
---

## Overview

UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: OpenShift Developer Tools and Services, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel for Spring Boot 4, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, … · no fix planned: Red Hat JBoss Enterprise Application Platform 7, OpenShift Developer Tools and Services, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89425.json)