JA
Product
jackson-core
6
CVEs
0
On KEV
8.7
Max CVSS
1
New 30D
Severity mix
Critical 0High 5Medium 1Low 0
Watch
Add jackson-core to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-68494 | 8.7 | Aug 4 | jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) Affected: 2.15.0 before 2.18.8; 2.19.0 before 2.21.4; 3.0.0 before 3.1.4 |
| CVE-2026-68498 | 7.5 | Oct 16 | jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service Affected: 2.16.0 before 2.18.10; 2.19.0 before 2.21.6; 2.22.0 before 2.22.2; 3.0.0 before 3.1.6; 3.2.0 before 3.2.2 |
| CVE-2026-89425 | 7.5 | Sep 23 | jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth Affected: 2.8.0 through 2.18.10; 2.19.0 through 2.21.6; 2.22.0 through 2.22.2; 3.0.0 through 3.1.6; 3.2.0 through 3.2.2 |
| CVE-2026-89407 | 7.5 | Sep 22 | jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS Affected: 2.17.0 through 2.18.10; 2.19.0 through 2.21.6; 2.22.0 through 2.22.2; 3.0.0 through 3.1.6; 3.2.0 through 3.2.1 |
| CVE-2026-29062 | 7.5 | Mar 6 | jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion Affected: >= 3.0.0, < 3.1.0 |
Showing 5