JA
Product
jackson-core
8
CVEs
0
On KEV
8.7
Max CVSS
1
New 30D
Severity mix
Critical 0High 6Medium 2Low 0
Watch
Add jackson-core to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-68494 | 8.7 | Aug 4 | jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) Affected: 2.15.0 before 2.18.8; 2.19.0 before 2.21.4; 3.0.0 before 3.1.4 |
| CVE-2025-52999 | 8.7 | Jun 25 | jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data Affected: < 2.15.0 |
| CVE-2026-68498 | 7.5 | Oct 16 | jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service Affected: 2.16.0 before 2.18.10; 2.19.0 before 2.21.6; 2.22.0 before 2.22.2; 3.0.0 before 3.1.6; 3.2.0 before 3.2.2 |
| CVE-2026-89425 | 7.5 | Sep 23 | jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth Affected: 2.8.0 through 2.18.10; 2.19.0 through 2.21.6; 2.22.0 through 2.22.2; 3.0.0 through 3.1.6; 3.2.0 through 3.2.2 |
| CVE-2026-89407 | 7.5 | Sep 22 | jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS Affected: 2.17.0 through 2.18.10; 2.19.0 through 2.21.6; 2.22.0 through 2.22.2; 3.0.0 through 3.1.6; 3.2.0 through 3.2.1 |
| CVE-2026-29062 | 7.5 | Mar 6 | jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion Affected: >= 3.0.0, < 3.1.0 |
| CVE-2026-18401 | 6.9 | Aug 4 | jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service Affected: 2.15.0 through 2.18.5; 2.19.0 before 2.21.1; 3.0.0 before 3.1.0 |
| CVE-2025-49128 | 4.0 | Jun 6 | Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation Affected: >= 2.0.0, < 2.13.0 |
Showing 8