{"id":"ECHO-a10b-dd74-a1af","upstream":["GHSA-72hv-8253-57qq","CVE-2026-18401"],"severity":[],"modified":"2026-08-09T08:33:45.238Z","affected":[{"package":{"ecosystem":"Echo:Maven","name":"com.fasterxml.jackson.core:jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.2+echo.1"}]}]},{"package":{"ecosystem":"Echo:Maven","name":"jackson-core","purl":"pkg:maven/jackson-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"package":{"ecosystem":"Echo:Maven","name":"tools.jackson.core:jackson-core","purl":"pkg:maven/tools.jackson.core/jackson-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]}],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/GHSA-72hv-8253-57qq"},{"type":"WEB","url":"https://github.com/advisories/GHSA-72hv-8253-57qq"}],"withdrawn":"2026-08-09T08:33:45.238Z","summary":"Two async-parser number-length DoS advisories in NonBlockingUtf8JsonParserBase\n(r7wm completes 72hv):\n  - GHSA-72hv-8253-57qq (High 8.7): async parser never enforced\n    StreamReadConstraints.maxNumberLength, so huge numbers exhausted memory/CPU;\n    length assignments now route through validating helpers.\n  - GHSA-r7wm-3cxj-wff9 (Moderate): follow-up — chunked digits still grew unbounded\n    on the streaming path; now validated at suspension points too.\nCommits b0c428e6 (#1555) and 4cdd5297 (#1611) applied verbatim — production code\nand both upstream regression tests byte-identical; only the release-notes and\nCI-workflow hunks are dropped.\nBackport changes: the two commits are combined into one patch because r7wm's\nstreaming-path fix builds on the _setIntLength() helper that 72hv introduces, and\nthe builder dry-runs each patch against pristine source (a dependent second patch\nwould be rejected). Verified byte-equal to both commits cherry-picked in order.\nTests: AsyncLargeNumberReadTest (3) + AsyncNumberLengthConsistencyTest (5); 7 of\nthe 8 fail on unpatched 2.20.2 and all pass with the patch (JDK 8).\n"}