A resource allocation vulnerability in the FasterXML jackson-core library can be exploited by an unauthenticated attacker to trigger a denial of service via memory exhaustion.

The library suffers from improper control of resource allocation (CWE-770), specifically failing to throttle or limit resources during parsing. This allows an unauthenticated, remote attacker to cause a denial of service (availability impact) by sending specially crafted inputs.

A successful exploit results in service unavailability, potentially causing significant downtime for applications relying on the jackson-core library for data processing. With a CVSS score of 8.7, this is a severe risk for any high-traffic service that parses external JSON data, as the lack of authentication requirements makes it easily reachable.

Immediate Action: Update the jackson-core library to versions 2.18.8, 2.21.4, or 3.1.4, depending on the current branch in use.

Proactive Monitoring: Monitor application memory usage and CPU spikes, which may indicate a denial-of-service attempt targeting the parsing engine.

Compensating Controls: Implement strict request size limits and input validation at the API gateway or load balancer level to drop malformed or excessively large JSON payloads.

Public Exploit Available: No (exploit_available: false)

Given the ease of exploitation and the potential for complete service disruption, this update is critical for all production systems using the affected versions of jackson-core. Teams should prioritize testing and deployment of the patched versions immediately.