CVE-2025-59250 — JDBC Driver for SQL Server Spoofing Vulnerability

Affected: Microsoft JDBC Driver for SQL Server 10.2, Microsoft JDBC Driver for SQL Server 11.2, Microsoft JDBC Driver for SQL Server 12.10, Microsoft JDBC Driver for SQL Server 12.2, Microsoft JDBC Driver for SQL Server 12.4, Microsoft JDBC Driver for SQL Server 12.6, Microsoft JDBC Driver for SQL Server 12.8, Microsoft JDBC Driver for SQL Server 13.2

Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.

GHSA-72hv-8253-57qq — jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition

Affected: Maven: tools.jackson.core:jackson-core, Maven: com.fasterxml.jackson.core:jackson-core

### Summary The non-blocking (async) JSON parser in `jackson-core` bypasses the `maxNumberLength` constraint (default: 1000 characters) defined in `StreamReadConstraints`. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS).

The standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy.

### Details The root cause is that the async parsing path in `NonBlockingUtf8JsonParserBase` (and related classes) does not call the methods responsible for number length validation.

- The number parsing methods (e.g., `_finishNumberIntegralPart`) accumulate digits into the `TextBuffer` without any length checks. - After parsing, they call `_valueComplete()`, which finalizes the token but does **not** call `resetInt()` or `resetFloat()`. - The `resetInt()`/`resetFloat()` methods in `ParserBase` are where the `validateIntegerLength()` and `validateFPLength()` checks are performed. - Because this validation step is skipped, the `maxNumberLength` constraint is never enforced in the async code path.

### PoC The following JUnit 5 test demonstrates the vulnerability. It shows that the async parser accepts a 5,000-digit number, whereas the limit should be 1,000.

```java package tools.jackson.core.unittest.dos;

import java.nio.charset.StandardCharsets;

import org…

Most recent entries from all

CVE-2025-59250 — JDBC Driver for SQL Server Spoofing Vulnerability

GHSA-72hv-8253-57qq — jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition