Overview
This advisory addresses a known security vulnerability identified in a third-party dependency used within DPGW.
Vulnerability Details
- CVE ID: None assigned (GitHub advisory GHSA-r7wm-3cxj-wff9; CWE-770, Allocation of Resources Without Limits or Throttling)
- Dependency Name: com.fasterxml.jackson.core:jackson-core
- Affected Version of Dependency:
< 2.18.8,2.19.0 – 2.21.3, and2.22.0(fixed in 2.18.8 / 2.21.4 / 2.22.1). The DPGW 1.12 branch bundled2.21.3, which falls in the affected range. - Severity Score: 8.7 High
(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
Affected Versions of DPGW
- <= 1.12.51-REL (the 1.12 branch declares
jackson-coreas a direct, explicitly pinned dependency and shipped the vulnerable2.21.3)
jackson-core is directly managed in the POM only on the 1.12 branch; on the other maintained branches it is pulled in transitively. This advisory tracks the 1.12 branch, where the dependency was explicitly bundled and has now been updated.
Risk Assessment & Applicability
Usage
DPGW uses Google Gson as its primary JSON library; it does not use Jackson for its own JSON handling and contains no direct references to the Jackson streaming API. jackson-core is present only as a transitive dependency — principally via com.auth0:java-jwt (JWT parsing, which uses the blocking ObjectMapper on a complete in-memory token string) and the Azure Storage SDK (which serializes with azure-json, not Jackson streaming). On the 1.12 branch, jackson-core is additionally pinned as a direct managed dependency to control the resolved version.
Analysis
GHSA-r7wm-3cxj-wff9 is an incomplete fix of a prior advisory (GHSA-72hv-8253-57qq). Jackson’s non-blocking asynchronous streaming parser fails to enforce the configured maxNumberLength limit (default 1000) when a JSON number’s integer digits arrive across multiple input chunks without a terminating byte. An attacker streaming a long run of digits in small chunks can force the parser to accumulate characters up to the maxStringLength limit (20 MiB default) — an amplification of roughly 20,000× over the configured number-length cap — leading to memory exhaustion (denial of service).
The vulnerable code path is reachable only through the non-blocking parser — JsonFactory.createNonBlockingByteArrayParser() / createNonBlockingByteBufferParser() (NonBlockingJsonParser) — which must be explicitly fed chunked input, typically from a reactive / non-blocking streaming pipeline.
DPGW never instantiates the non-blocking parser: there is no direct Jackson usage anywhere in the codebase, and no reactive pipeline that feeds chunked bytes into a Jackson async parser. The only component that actually parses JSON with Jackson (java-jwt) uses the standard blocking parser on a fully-buffered in-memory string, which is not affected by this issue. The vulnerable code path is therefore unreachable in DPGW.
Status
Not affected
Impact on DPGW
No impact. The vulnerability is confined to Jackson’s non-blocking asynchronous parser, which DPGW does not use. The jackson-core artifact is only ever exercised through blocking, fully-buffered parsing by transitive consumers, so the memory-exhaustion condition cannot be triggered.
Remediation & Mitigations
Scheduled fix
Although DPGW is not affected, the vulnerable dependency version was cleared from the 1.12 build as hygiene: jackson-core was updated 2.21.3 → 2.21.5 (commit d4c148f506, 2026-07-23). This will ship in the next 1.12 release:
– 1.12.52-REL — bundles jackson-core 2.21.5
User Actions
No user action required.