AIKIDO-2026-919437

TL;DR

jackson-core does not call validateIntegerLength() when the non-blocking parser runs out of input in MINOR_NUMBER_INTEGER_DIGITS and returns NOT_AVAILABLE, an incomplete fix for CVE-2026-18401. A stream of digits with no terminator grows the text buffer up to maxStringLength instead of maxNumberLength, so a single connection can exhaust heap memory. Synchronous parsers and the async parser on a complete value still enforce the limit. The fix adds _setIntLength() calls on those integer digit exits before the parser returns NOT_AVAILABLE.