Every CVE Search/ Get API key

CVE-2026-68494

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

8.7 HighFix available

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.

The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.

As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.

The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.

Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.

Exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.

This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.46%Up 0.1 points since Aug 5, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.

The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.

As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.

The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.

Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.

Exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.

This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08).

Record
CVE-2026-68494
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2026-52703 8.7

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.

The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.

As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.

The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.

Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.

Exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.

This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08).

Record
EUVD-2026-52703
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-642r-3gj9-2pj5 8.7

Duplicate Advisory: jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-r7wm-3cxj-wff9. This link is maintained to preserve external references.

Original Description

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.

The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a . or e/E is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.

As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.

The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.

Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.

Exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.

This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, from 2.19.0 through 2.21.3, and from 2.22.0 through 2.22.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3 and from 3.2.0 through 3.2.0. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound.

Record
GHSA-642r-3gj9-2pj5
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-770
Updated
2026-11-02
GitHub AdvisoriesGHSA-r7wm-3cxj-wff9 8.7

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Summary

The fix released in jackson-core 2.18.6 and 2.21.1 for GHSA-72hv-8253-57qq (Number Length Constraint Bypass in Async Parser, published 2026-02-28) is incomplete. The fix commit b0c428e6 (#1555) wired validateIntegerLength into a new _setIntLength helper and called it at every place where the integer portion of a number is decided (terminator byte arrived, . / e/E seen, end-of-feed inside a fully-buffered value). It did not call it on the much more attacker-relevant path: "ran out of input while still inside MINOR_NUMBER_INTEGER_DIGITS, return NOT_AVAILABLE to caller".

As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, can keep the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows on every chunk, and validateIntegerLength is never invoked. The accumulator is only gated by maxStringLength (20 MiB default) — a ~20,000x amplification of the documented maxNumberLength (1000 default).

This is the same vulnerability class, same advisory wording ("Memory Exhaustion: Unbounded allocation in TextBuffer from excessively long numbers"), same parser class — just the streaming path the original fix didn't cover. The fix to the fraction path is correct (see _finishFloatFraction at line 1834-1837 of NonBlockingUtf8JsonParserBase.java in 2.18.6, where _setFractLength(fractLen) IS called before the NOT_AVAILABLE return); the equivalent call is missing from every integer-digit path.

Affected versions

Verified on the patched releases:

  • com.fasterxml.jackson.core:jackson-core 2.18.6
  • com.fasterxml.jackson.core:jackson-core 2.21.1

Structurally identical code in tools.jackson.core 3.0.x / 3.1.x — same NonBlockingUtf8JsonParserBase class, same _setIntLength rollout, same NOT_AVAILABLE returns without validation. Not retested but presumed vulnerable.

Affected code

src/main/java/com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java in 2.18.6 / 2.21.1.

Site 1 — _startPositiveNumber(int ch) lines 1320-1330:

if (outPtr >= outBuf.length) {
    // NOTE: must expand to ensure contents all in a single buffer (to keep
    // other parts of parsing simpler)
    outBuf = _textBuffer.expandCurrentSegment();
}
outBuf[outPtr++] = (char) ch;
if (++_inputPtr >= _inputEnd) {
    _minorState = MINOR_NUMBER_INTEGER_DIGITS;
    _textBuffer.setCurrentLength(outPtr);
    return _updateTokenToNA();          // <-- no validateIntegerLength(outPtr)
}

Site 2 — _finishNumberIntegralPart lines 1691-1727:

protected JsonToken _finishNumberIntegralPart(char[] outBuf, int outPtr) throws IOException {
    int negMod = _numberNegative ? -1 : 0;

    while (true) {
        if (_inputPtr >= _inputEnd) {
            _minorState = MINOR_NUMBER_INTEGER_DIGITS;
            _textBuffer.setCurrentLength(outPtr);
            return _updateTokenToNA();    // <-- no validateIntegerLength(outPtr + negMod)
        }
        int ch = getByteFromBuffer(_inputPtr) & 0xFF;
        if (ch < INT_0) {
            if (ch == INT_PERIOD) {
                _setIntLength(outPtr+negMod);   // <-- validated here
                ++_inputPtr;
                return _startFloat(outBuf, outPtr, ch);
            }
            break;
        }
        if (ch > INT_9) {
            if ((ch | 0x20) == INT_e) {
                _setIntLength(outPtr+negMod);   // <-- validated here
                ++_inputPtr;
                return _startFloat(outBuf, outPtr, ch);
            }
            break;
        }
        ++_inputPtr;
        if (outPtr >= outBuf.length) {
            outBuf =…
Record
GHSA-r7wm-3cxj-wff9
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770
Updated
2026-11-02
NVD 8.7

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.

The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.

As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.

The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.

Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.

Exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.

This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08).

Record
CVE-2026-68494
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-770
Updated
2026-11-02
OSV 8.7

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.

The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.

As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.

The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.

Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.

Exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.

This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08).

Record
CVE-2026-68494
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770
Updated
2026-11-02
Show 42 moreShow less
OSVGHSA-642r-3gj9-2pj5 8.7

Duplicate Advisory: jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-r7wm-3cxj-wff9. This link is maintained to preserve external references.

Original Description

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.

The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a . or e/E is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.

As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.

The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.

Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.

Exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.

This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, from 2.19.0 through 2.21.3, and from 2.22.0 through 2.22.0, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3 and from 3.2.0 through 3.2.0. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound.

Record
GHSA-642r-3gj9-2pj5
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-770
Updated
2026-11-02
OSVGHSA-r7wm-3cxj-wff9 8.7

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Summary

The fix released in jackson-core 2.18.6 and 2.21.1 for GHSA-72hv-8253-57qq (Number Length Constraint Bypass in Async Parser, published 2026-02-28) is incomplete. The fix commit b0c428e6 (#1555) wired validateIntegerLength into a new _setIntLength helper and called it at every place where the integer portion of a number is decided (terminator byte arrived, . / e/E seen, end-of-feed inside a fully-buffered value). It did not call it on the much more attacker-relevant path: "ran out of input while still inside MINOR_NUMBER_INTEGER_DIGITS, return NOT_AVAILABLE to caller".

As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, can keep the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows on every chunk, and validateIntegerLength is never invoked. The accumulator is only gated by maxStringLength (20 MiB default) — a ~20,000x amplification of the documented maxNumberLength (1000 default).

This is the same vulnerability class, same advisory wording ("Memory Exhaustion: Unbounded allocation in TextBuffer from excessively long numbers"), same parser class — just the streaming path the original fix didn't cover. The fix to the fraction path is correct (see _finishFloatFraction at line 1834-1837 of NonBlockingUtf8JsonParserBase.java in 2.18.6, where _setFractLength(fractLen) IS called before the NOT_AVAILABLE return); the equivalent call is missing from every integer-digit path.

Affected versions

Verified on the patched releases:

  • com.fasterxml.jackson.core:jackson-core 2.18.6
  • com.fasterxml.jackson.core:jackson-core 2.21.1

Structurally identical code in tools.jackson.core 3.0.x / 3.1.x — same NonBlockingUtf8JsonParserBase class, same _setIntLength rollout, same NOT_AVAILABLE returns without validation. Not retested but presumed vulnerable.

Affected code

src/main/java/com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java in 2.18.6 / 2.21.1.

Site 1 — _startPositiveNumber(int ch) lines 1320-1330:

if (outPtr >= outBuf.length) {
    // NOTE: must expand to ensure contents all in a single buffer (to keep
    // other parts of parsing simpler)
    outBuf = _textBuffer.expandCurrentSegment();
}
outBuf[outPtr++] = (char) ch;
if (++_inputPtr >= _inputEnd) {
    _minorState = MINOR_NUMBER_INTEGER_DIGITS;
    _textBuffer.setCurrentLength(outPtr);
    return _updateTokenToNA();          // <-- no validateIntegerLength(outPtr)
}

Site 2 — _finishNumberIntegralPart lines 1691-1727:

protected JsonToken _finishNumberIntegralPart(char[] outBuf, int outPtr) throws IOException {
    int negMod = _numberNegative ? -1 : 0;

    while (true) {
        if (_inputPtr >= _inputEnd) {
            _minorState = MINOR_NUMBER_INTEGER_DIGITS;
            _textBuffer.setCurrentLength(outPtr);
            return _updateTokenToNA();    // <-- no validateIntegerLength(outPtr + negMod)
        }
        int ch = getByteFromBuffer(_inputPtr) & 0xFF;
        if (ch < INT_0) {
            if (ch == INT_PERIOD) {
                _setIntLength(outPtr+negMod);   // <-- validated here
                ++_inputPtr;
                return _startFloat(outBuf, outPtr, ch);
            }
            break;
        }
        if (ch > INT_9) {
            if ((ch | 0x20) == INT_e) {
                _setIntLength(outPtr+negMod);   // <-- validated here
                ++_inputPtr;
                return _startFloat(outBuf, outPtr, ch);
            }
            break;
        }
        ++_inputPtr;
        if (outPtr >= outBuf.length) {
            outBuf =…
Record
GHSA-r7wm-3cxj-wff9
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770
Updated
2026-11-02
OSVRHSA-2026:53644 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate

Record
RHSA-2026:53644
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:53645 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 Security update

Record
RHSA-2026:53645
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:53646 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 Security update

Record
RHSA-2026:53646
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63327 8.1

Red Hat Security Advisory: Satellite 6.16.13 Async Update

Record
RHSA-2026:63327
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63385 8.8

Red Hat Security Advisory: Satellite 6.19.4 Async Update

Record
RHSA-2026:63385
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63386 8.1

Red Hat Security Advisory: Satellite 6.18.9 Async Update

Record
RHSA-2026:63386
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63387 8.1

Red Hat Security Advisory: Satellite 6.17.11 Async Update

Record
RHSA-2026:63387
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:70228 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

Record
RHSA-2026:70228
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:70229 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

Record
RHSA-2026:70229
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:70230 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

Record
RHSA-2026:70230
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:76128 9.6

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 7

Record
RHSA-2026:76128
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2026:76129 9.6

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 8

Record
RHSA-2026:76129
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2026:76130 9.6

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 9

Record
RHSA-2026:76130
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-68494 8.7

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller. As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes. The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase. Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected. Exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed. This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08).

Record
UBUNTU-CVE-2026-68494
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVCLSA-2026-1789484097 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (4 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 4 CVEs. Fixed in 2.17.2-tuxcare.1.

Record
CLSA-2026-1789484097
Updated
2026-11-02
OSVCLSA-2026-1791485698 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.17.1-tuxcare.1.

Record
CLSA-2026-1791485698
Updated
2026-11-02
OSVCLSA-2026-1791485784 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (4 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 4 CVEs. Fixed in 2.17.3-tuxcare.2.

Record
CLSA-2026-1791485784
Updated
2026-11-02
OSVCLSA-2026-1791493683 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.14.2-tuxcare.3.

Record
CLSA-2026-1791493683
Updated
2026-11-02
OSVCLSA-2026-1791495450 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.14.1-tuxcare.2.

Record
CLSA-2026-1791495450
Updated
2026-11-02
OSVCLSA-2026-1792399460 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.13.2-tuxcare.1.

Record
CLSA-2026-1792399460
Updated
2026-11-02
OSVCLSA-2026-1792399472 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.13.4-tuxcare.1.

Record
CLSA-2026-1792399472
Updated
2026-11-02
OSVCLSA-2026-1792428449 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.18.0-tuxcare.1.

Record
CLSA-2026-1792428449
Updated
2026-11-02
OSVCLSA-2026-1792431620 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.16.1-tuxcare.1.

Record
CLSA-2026-1792431620
Updated
2026-11-02
OSVCLSA-2026-1792431627 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.15.0-tuxcare.1.

Record
CLSA-2026-1792431627
Updated
2026-11-02
OSVCLSA-2026-1792434304 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (4 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 4 CVEs. Fixed in 2.13.3-tuxcare.1.

Record
CLSA-2026-1792434304
Updated
2026-11-02
OSVCLSA-2026-1793085045 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.18.4.1-tuxcare.2.

Record
CLSA-2026-1793085045
Updated
2026-11-02
OSVCLSA-2026-1793085177 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.20.1-tuxcare.1.

Record
CLSA-2026-1793085177
Updated
2026-11-02
OSVCLSA-2026-1793085261 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.15.4-tuxcare.2.

Record
CLSA-2026-1793085261
Updated
2026-11-02
OSVCLSA-2026-1793087308 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.13.5-tuxcare.2.

Record
CLSA-2026-1793087308
Updated
2026-11-02
OSVCLSA-2026-1793196284 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.15.2-tuxcare.2.

Record
CLSA-2026-1793196284
Updated
2026-11-02
OSVCLSA-2026-1793196558 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.15.3-tuxcare.2.

Record
CLSA-2026-1793196558
Updated
2026-11-02
OSVCLSA-2026-1793196650 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.14.3-tuxcare.2.

Record
CLSA-2026-1793196650
Updated
2026-11-02
OSVCLSA-2026-1793599822 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.21.2-tuxcare.2.

Record
CLSA-2026-1793599822
Updated
2026-11-02
OSVopenSUSE-SU-2026:11638-1 No score

jackson-core-2.18.9-2.1 on GA media

These are all security issues fixed in the jackson-core-2.18.9-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11638-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22034-1 No score

Security update for jackson-annotations, jackson-core, jackson-databind

This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:

  • CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856).
  • CVE-2026-19032: deserializer for java.nio.file.Path resolves attacker-supplied URIs without restricting the URI scheme (bsc#1277883).
  • CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
  • CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).
  • CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
  • CVE-2026-83557: incomplete PolymorphicTypeValidator denylist allows for arbitrary Comparable deserialization (bsc#1278008).
  • CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
  • CVE-2026-89425: UTF8DataInputJsonParser._reportInvalidToken()lacks maxErrorTokenLength limit, which allows for unbounded StringBuilder growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).
  • CVE-2026-91776: TypeDeserializerBase._findDeserializer() caches the resolved deserializer under the raw, attacker- supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).
  • CVE-2026-91777: forward-reference completion for @JsonIdentityInfo object IDs performs a linear scan of the pending- reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization (bsc#1282492).

Changes for jackson-annotations:

  • Update to 2.18.11

Changes for jackson-core:

  • Update to 2.18.11
  • #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645, CVE-2026-89407)
  • #1698: UTF8DataInputJsonParser does not honor maxErrorTokenLength when reporting an unrecognized token (bsc#1282505, CVE-2026-89425)
  • #1642: Fix maxDocumentLength bypass in async parser single-feedInput() case [GHSA-2c4j-63jj-9fqr]
  • #1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498) of async parser (bsc#1273857, CVE-2026-68494) non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

Changes for jackson-databind:

  • Update to 2.18.11
  • #6185: Bracket unresolved IPv6 host name in InetSocketAddress serialization
  • #6203: Prevent unbounded growth of type id cache in TypeDeserializer (bsc#1282491, CVE-2026-91776)
  • #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
  • #6099: Resolve classes without initialization in TypeFactory.findClass()
  • #6116: Reject non-ASCII digits in InetAddress literal validation
  • #6127: Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
  • #6129: Limit the supported URL schemes for java.nio.file.Path deserialization (bsc#1277883, CVE-2026-19032)
  • #6156: Add java.lang.Comparable in set of unsafe polymorphic base types (bsc#1278008, CVE-2026-83557)
  • #6165: Apply number length limits to BigDecimal/BigInteger/ /Double/Float Map keys
Record
openSUSE-SU-2026:22034-1
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-68494 No score

CVE-2026-68494 in com.fasterxml.jackson.core:jackson-core - Patched by Root

Root has patched CVE-2026-68494 in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2026-68494
Updated
2026-11-05
OSVROOT-APP-MAVEN-GHSA-642r-3gj9-2pj5 No score

GHSA-642r-3gj9-2pj5 in tools.jackson.core:jackson-core - Patched by Root

Root has patched GHSA-642r-3gj9-2pj5 in the tools.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-GHSA-642r-3gj9-2pj5
Updated
2026-11-02
OSVROOT-APP-MAVEN-GHSA-r7wm-3cxj-wff9 No score

GHSA-r7wm-3cxj-wff9 in com.fasterxml.jackson.core:jackson-core - Patched by Root

Root has patched GHSA-r7wm-3cxj-wff9 in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-GHSA-r7wm-3cxj-wff9
Updated
2026-11-05
OSVSUSE-SU-2026:24149-1 No score

Security update for jackson-annotations, jackson-core, jackson-databind

This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:

  • CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856).
  • CVE-2026-19032: deserializer for java.nio.file.Path resolves attacker-supplied URIs without restricting the URI scheme (bsc#1277883).
  • CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
  • CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).
  • CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
  • CVE-2026-83557: incomplete PolymorphicTypeValidator denylist allows for arbitrary Comparable deserialization (bsc#1278008).
  • CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
  • CVE-2026-89425: UTF8DataInputJsonParser._reportInvalidToken()lacks maxErrorTokenLength limit, which allows for unbounded StringBuilder growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).
  • CVE-2026-91776: TypeDeserializerBase._findDeserializer() caches the resolved deserializer under the raw, attacker- supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).
  • CVE-2026-91777: forward-reference completion for @JsonIdentityInfo object IDs performs a linear scan of the pending- reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization (bsc#1282492).

Changes for jackson-annotations:

  • Update to 2.18.11

Changes for jackson-core:

  • Update to 2.18.11
  • #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645, CVE-2026-89407)
  • #1698: UTF8DataInputJsonParser does not honor maxErrorTokenLength when reporting an unrecognized token (bsc#1282505, CVE-2026-89425)
  • #1642: Fix maxDocumentLength bypass in async parser single-feedInput() case [GHSA-2c4j-63jj-9fqr]
  • #1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498) of async parser (bsc#1273857, CVE-2026-68494) non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

Changes for jackson-databind:

  • Update to 2.18.11
  • #6185: Bracket unresolved IPv6 host name in InetSocketAddress serialization
  • #6203: Prevent unbounded growth of type id cache in TypeDeserializer (bsc#1282491, CVE-2026-91776)
  • #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
  • #6099: Resolve classes without initialization in TypeFactory.findClass()
  • #6116: Reject non-ASCII digits in InetAddress literal validation
  • #6127: Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
  • #6129: Limit the supported URL schemes for java.nio.file.Path deserialization (bsc#1277883, CVE-2026-19032)
  • #6156: Add java.lang.Comparable in set of unsafe polymorphic base types (bsc#1278008, CVE-2026-83557)
  • #6165: Apply number length limits to BigDecimal/BigInteger/ /Double/Float Map keys
Record
SUSE-SU-2026:24149-1
Updated
2026-11-02
OSVSUSE-SU-2026:4394-1 No score

Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues:

  • CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856).
  • CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
  • CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).
  • CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).
  • CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
  • CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
  • CVE-2026-89425: UTF8DataInputJsonParser._reportInvalidToken()lacks maxErrorTokenLength limit, which allows for unbounded StringBuilder growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).

Changes for jackson-annotations:

  • Update to 2.18.11

Changes for jackson-bom:

  • Update to 2.18.11

Changes for jackson-core:

  • Update to 2.18.11
  • #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645, CVE-2026-89407)
  • #1698: UTF8DataInputJsonParser does not honor maxErrorTokenLength when reporting an unrecognized token (bsc#1282505, CVE-2026-89425)
  • #1642: Fix maxDocumentLength bypass in async parser single-feedInput() case [GHSA-2c4j-63jj-9fqr]
  • #1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498) of async parser (bsc#1273857, CVE-2026-68494) non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

Changes for jackson-databind:

  • Update to 2.18.11
  • #6185: Bracket unresolved IPv6 host name in InetSocketAddress serialization
  • #6203: Prevent unbounded growth of type id cache in TypeDeserializer (bsc#1282491, CVE-2026-91776)
  • #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
  • #6099: Resolve classes without initialization in TypeFactory.findClass()
  • #6116: Reject non-ASCII digits in InetAddress literal validation
  • #6127: Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
  • #6129: Limit the supported URL schemes for java.nio.file.Path deserialization (bsc#1277883, CVE-2026-19032)
  • #6156: Add java.lang.Comparable in set of unsafe polymorphic base types (bsc#1278008, CVE-2026-83557)
  • #6165: Apply number length limits to BigDecimal/BigInteger/ /Double/Float Map keys

Changes for jackson-dataformat-xml:

  • Update to 2.18.11
  • Fix build to avoid past-JDK-8 bytecode generation
  • #891: Enforce StreamReadConstraints.maxNestingDepth in FromXmlParser

Changes for jackson-dataformats-binary:

  • Update to 2.18.11
  • #783: (protobuf) Support StreamReadConstraints.maxDocumentLength in ProtobufParser
  • #785: (avro) Support StreamReadConstraints.maxDocumentLength and maxTokenCount in Avro parser
  • #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion parser (partial fix for #358)
  • #805: (ion) Support StreamReadConstraints.maxDocumentLength in Ion parser (partial fix for #358)
  • #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639, CVE-2026-68495)
  • #726: (smile) Ensure maxNameLength limit enforced for Smile parser (bsc#1282640, CVE-2026-68496)
  • #727: (cbor) CBORParser.nextFieldName(SerializableString) confuses 5-bit length marker 23 with 24 ('1-byte length suffix follows')
  • #728: (cbor) CBORParser.nextFieldName(SerializableString) consumes Object entry slot twice on fast-path miss, truncating definite-length Objects
  • #733: (cbor) Long Strings not added to 'stringref' reference table, breaking following references
  • #735: (cbor) 'stringref' property-name paths pass 5-bit length marker instead of actual length to shouldReferenceString()
  • #736: (cbor) Long…
Record
SUSE-SU-2026:4394-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
com.fasterxml.jackson.core:jackson-core
Maven
 before 2.18.8
2.18.8
com.fasterxml.jackson.core:jackson-core
Maven
 2.19.0 up to 2.21.4
2.21.4
tools.jackson.core:jackson-core
Maven
 3.0.0 up to 3.1.4
3.1.4
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.17.2 up to 2.17.2-tuxcare.1
2.17.2-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 4 CVEs
 2.17.1 up to 2.17.1-tuxcare.1
2.17.1-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 3 CVEs
 2.17.3 up to 2.17.3-tuxcare.2, plus listed versions
2.17.3-tuxcare.1
2.17.3-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.14.2 up to 2.14.2-tuxcare.3, plus listed versions
2.14.2-tuxcare.12.14.2-tuxcare.2
2.14.2-tuxcare.3
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.14.1 up to 2.14.1-tuxcare.2, plus listed versions
2.14.1-tuxcare.1
2.14.1-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 3 CVEs
 2.13.2 up to 2.13.2-tuxcare.1
2.13.2-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 3 CVEs
 2.13.4 up to 2.13.4-tuxcare.1
2.13.4-tuxcare.1
Show 290 moreShow less
Affected packages
PackageAffectedFixed
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.18.0 up to 2.18.0-tuxcare.1
2.18.0-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.16.1 up to 2.16.1-tuxcare.1
2.16.1-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 3 CVEs
 2.15.0 up to 2.15.0-tuxcare.1
2.15.0-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.13.3 up to 2.13.3-tuxcare.1
2.13.3-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.18.4.1 up to 2.18.4.1-tuxcare.2, plus listed versions
2.18.4.1-tuxcare.1
2.18.4.1-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 4 CVEs
 2.20.1 up to 2.20.1-tuxcare.1
2.20.1-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.15.4 up to 2.15.4-tuxcare.2, plus listed versions
2.15.4-tuxcare.1
2.15.4-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.13.5 up to 2.13.5-tuxcare.2, plus listed versions
2.13.5-tuxcare.1
2.13.5-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.15.2 up to 2.15.2-tuxcare.2, plus listed versions
2.15.2-tuxcare.1
2.15.2-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.15.3 up to 2.15.3-tuxcare.2, plus listed versions
2.15.3-tuxcare.1
2.15.3-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.14.3 up to 2.14.3-tuxcare.2, plus listed versions
2.14.3-tuxcare.1
2.14.3-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.21.2 up to 2.21.2-tuxcare.2, plus listed versions
2.21.2-tuxcare.1
2.21.2-tuxcare.2
com.fasterxml.jackson.core:jackson-core
Maven
 before 2.18.8, plus listed versions
2.0.02.0.0-RC12.0.0-RC22.0.0-RC32.0.1
Show 45 moreShow less
2.0.22.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.12.10.22.10.32.10.42.10.52.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.72.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.32.13.42.13.52.14.02.14.0-rc1
2.18.8
com.fasterxml.jackson.core:jackson-core
Maven
 2.19.0 up to 2.21.4, plus listed versions
2.19.12.19.22.19.32.19.42.20.0
Show 7 moreShow less
2.20.0-rc12.20.12.20.22.21.02.21.12.21.22.21.3
2.21.4
tools.jackson.core:jackson-core
Maven
 3.0.0 up to 3.1.4, plus listed versions
3.0.13.0.23.0.33.0.43.1.0
Show 4 moreShow less
3.1.0-rc13.1.13.1.23.1.3
3.1.4
eap7-activemq-artemis
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-jms-client
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-jms-server
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-ra
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-service-extensions
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-activemq-artemis-tools
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el7eap
0:2.16.0-22.redhat_00057.1.el7eap
eap7-glassfish-jsf
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.3.14-11.SP11_redhat_00001.1.el7eap
0:2.3.14-11.SP11_redhat_00001.1.el7eap
eap7-ironjacamar
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el7eap
0:1.5.26-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-common-api
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el7eap
0:1.5.26-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-common-impl
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el7eap
0:1.5.26-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-common-spi
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el7eap
0:1.5.26-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-core-api
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el7eap
0:1.5.26-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-core-impl
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el7eap
0:1.5.26-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-deployers-common
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el7eap
0:1.5.26-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-jdbc
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el7eap
0:1.5.26-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-validator
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el7eap
0:1.5.26-2.Final_redhat_00001.1.el7eap
eap7-jackson-annotations
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el7eap
0:2.18.8-1.redhat_00003.1.el7eap
eap7-jackson-core
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el7eap
0:2.18.8-1.redhat_00003.1.el7eap
eap7-jackson-databind
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el7eap
0:2.18.8-1.redhat_00003.1.el7eap
eap7-jackson-datatype-jdk8
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el7eap
0:2.18.8-1.redhat_00003.1.el7eap
eap7-jackson-datatype-jsr310
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el7eap
0:2.18.8-1.redhat_00003.1.el7eap
eap7-jackson-jaxrs-base
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el7eap
0:2.18.8-1.redhat_00003.1.el7eap
eap7-jackson-jaxrs-json-provider
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el7eap
0:2.18.8-1.redhat_00003.1.el7eap
eap7-jackson-jaxrs-providers
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el7eap
0:2.18.8-1.redhat_00003.1.el7eap
eap7-jackson-module-jaxb-annotations
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el7eap
0:2.18.8-1.redhat_00003.1.el7eap
eap7-jackson-modules-base
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el7eap
0:2.18.8-1.redhat_00003.1.el7eap
eap7-jackson-modules-java8
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el7eap
0:2.18.8-1.redhat_00003.1.el7eap
eap7-jboss-remoting
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:5.0.31-3.SP2_redhat_00001.1.el7eap
0:5.0.31-3.SP2_redhat_00001.1.el7eap
eap7-jboss-server-migration
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:1.10.0-46.Final_redhat_00044.1.el7eap
0:1.10.0-46.Final_redhat_00044.1.el7eap
eap7-jboss-server-migration-cli
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:1.10.0-46.Final_redhat_00044.1.el7eap
0:1.10.0-46.Final_redhat_00044.1.el7eap
eap7-jboss-server-migration-core
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:1.10.0-46.Final_redhat_00044.1.el7eap
0:1.10.0-46.Final_redhat_00044.1.el7eap
eap7-netty
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-all
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-buffer
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-codec
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-codec-dns
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-codec-haproxy
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-codec-http
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-codec-http2
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-codec-memcache
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-codec-mqtt
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-codec-redis
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-codec-smtp
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-codec-socks
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-codec-stomp
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-codec-xml
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-common
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-handler
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-handler-proxy
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-resolver
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-resolver-dns
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-resolver-dns-classes-macos
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-transport
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-transport-classes-epoll
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-transport-classes-kqueue
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-transport-native-epoll
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-transport-native-epoll-debuginfo
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-transport-native-unix-common
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-netty-transport-sctp
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el7eap
0:4.1.135-1.Final_redhat_00001.1.el7eap
eap7-picketlink-api
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el7eap
0:2.5.5-24.SP12_redhat_00016.1.el7eap
eap7-picketlink-bindings
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.5.5-30.SP12_redhat_00020.1.el7eap
0:2.5.5-30.SP12_redhat_00020.1.el7eap
eap7-picketlink-common
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el7eap
0:2.5.5-24.SP12_redhat_00016.1.el7eap
eap7-picketlink-config
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el7eap
0:2.5.5-24.SP12_redhat_00016.1.el7eap
eap7-picketlink-federation
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el7eap
0:2.5.5-24.SP12_redhat_00016.1.el7eap
eap7-picketlink-idm-api
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el7eap
0:2.5.5-24.SP12_redhat_00016.1.el7eap
eap7-picketlink-idm-impl
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el7eap
0:2.5.5-24.SP12_redhat_00016.1.el7eap
eap7-picketlink-idm-simple-schema
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el7eap
0:2.5.5-24.SP12_redhat_00016.1.el7eap
eap7-picketlink-impl
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el7eap
0:2.5.5-24.SP12_redhat_00016.1.el7eap
eap7-picketlink-wildfly8
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.5.5-30.SP12_redhat_00020.1.el7eap
0:2.5.5-30.SP12_redhat_00020.1.el7eap
eap7-undertow
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:2.2.40-2.SP3_redhat_00001.1.el7eap
0:2.2.40-2.SP3_redhat_00001.1.el7eap
eap7-wildfly
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:7.4.25-2.GA_redhat_00001.1.el7eap
0:7.4.25-2.GA_redhat_00001.1.el7eap
eap7-wildfly-java-jdk11
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:7.4.25-2.GA_redhat_00001.1.el7eap
0:7.4.25-2.GA_redhat_00001.1.el7eap
eap7-wildfly-java-jdk8
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:7.4.25-2.GA_redhat_00001.1.el7eap
0:7.4.25-2.GA_redhat_00001.1.el7eap
eap7-wildfly-javadocs
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:7.4.25-2.GA_redhat_00001.1.el7eap
0:7.4.25-2.GA_redhat_00001.1.el7eap
eap7-wildfly-modules
Red Hat:jboss_enterprise_application_platform_els:7.4::el7
From an advisory covering 41 CVEs
 before 0:7.4.25-2.GA_redhat_00001.1.el7eap
0:7.4.25-2.GA_redhat_00001.1.el7eap
eap7-activemq-artemis
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-jms-client
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-jms-server
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-ra
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-service-extensions
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-activemq-artemis-tools
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el8eap
0:2.16.0-22.redhat_00057.1.el8eap
eap7-glassfish-jsf
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.3.14-11.SP11_redhat_00001.1.el8eap
0:2.3.14-11.SP11_redhat_00001.1.el8eap
eap7-ironjacamar
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el8eap
0:1.5.26-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-common-api
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el8eap
0:1.5.26-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-common-impl
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el8eap
0:1.5.26-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-common-spi
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el8eap
0:1.5.26-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-core-api
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el8eap
0:1.5.26-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-core-impl
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el8eap
0:1.5.26-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-deployers-common
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el8eap
0:1.5.26-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-jdbc
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el8eap
0:1.5.26-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-validator
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el8eap
0:1.5.26-2.Final_redhat_00001.1.el8eap
eap7-jackson-annotations
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el8eap
0:2.18.8-1.redhat_00003.1.el8eap
eap7-jackson-core
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el8eap
0:2.18.8-1.redhat_00003.1.el8eap
eap7-jackson-databind
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el8eap
0:2.18.8-1.redhat_00003.1.el8eap
eap7-jackson-datatype-jdk8
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el8eap
0:2.18.8-1.redhat_00003.1.el8eap
eap7-jackson-datatype-jsr310
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el8eap
0:2.18.8-1.redhat_00003.1.el8eap
eap7-jackson-jaxrs-base
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el8eap
0:2.18.8-1.redhat_00003.1.el8eap
eap7-jackson-jaxrs-json-provider
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el8eap
0:2.18.8-1.redhat_00003.1.el8eap
eap7-jackson-jaxrs-providers
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el8eap
0:2.18.8-1.redhat_00003.1.el8eap
eap7-jackson-module-jaxb-annotations
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el8eap
0:2.18.8-1.redhat_00003.1.el8eap
eap7-jackson-modules-base
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el8eap
0:2.18.8-1.redhat_00003.1.el8eap
eap7-jackson-modules-java8
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.18.8-1.redhat_00003.1.el8eap
0:2.18.8-1.redhat_00003.1.el8eap
eap7-jboss-remoting
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:5.0.31-3.SP2_redhat_00001.1.el8eap
0:5.0.31-3.SP2_redhat_00001.1.el8eap
eap7-jboss-server-migration
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:1.10.0-46.Final_redhat_00044.1.el8eap
0:1.10.0-46.Final_redhat_00044.1.el8eap
eap7-jboss-server-migration-cli
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:1.10.0-46.Final_redhat_00044.1.el8eap
0:1.10.0-46.Final_redhat_00044.1.el8eap
eap7-jboss-server-migration-core
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:1.10.0-46.Final_redhat_00044.1.el8eap
0:1.10.0-46.Final_redhat_00044.1.el8eap
eap7-netty
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-all
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-buffer
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-codec
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-codec-dns
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-codec-haproxy
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-codec-http
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-codec-http2
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-codec-memcache
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-codec-mqtt
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-codec-redis
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-codec-smtp
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-codec-socks
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-codec-stomp
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-codec-xml
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-common
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-handler
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-handler-proxy
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-resolver
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-resolver-dns
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-resolver-dns-classes-macos
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-transport
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-transport-classes-epoll
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-transport-classes-kqueue
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-transport-native-epoll
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-transport-native-epoll-debuginfo
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-transport-native-unix-common
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-netty-transport-sctp
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:4.1.135-1.Final_redhat_00001.1.el8eap
0:4.1.135-1.Final_redhat_00001.1.el8eap
eap7-picketlink-api
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el8eap
0:2.5.5-24.SP12_redhat_00016.1.el8eap
eap7-picketlink-bindings
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.5.5-30.SP12_redhat_00020.1.el8eap
0:2.5.5-30.SP12_redhat_00020.1.el8eap
eap7-picketlink-common
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el8eap
0:2.5.5-24.SP12_redhat_00016.1.el8eap
eap7-picketlink-config
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el8eap
0:2.5.5-24.SP12_redhat_00016.1.el8eap
eap7-picketlink-federation
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el8eap
0:2.5.5-24.SP12_redhat_00016.1.el8eap
eap7-picketlink-idm-api
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el8eap
0:2.5.5-24.SP12_redhat_00016.1.el8eap
eap7-picketlink-idm-impl
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el8eap
0:2.5.5-24.SP12_redhat_00016.1.el8eap
eap7-picketlink-idm-simple-schema
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el8eap
0:2.5.5-24.SP12_redhat_00016.1.el8eap
eap7-picketlink-impl
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.5.5-24.SP12_redhat_00016.1.el8eap
0:2.5.5-24.SP12_redhat_00016.1.el8eap
eap7-picketlink-wildfly8
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.5.5-30.SP12_redhat_00020.1.el8eap
0:2.5.5-30.SP12_redhat_00020.1.el8eap
eap7-undertow
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:2.2.40-1.SP3_redhat_00001.1.el8eap
0:2.2.40-1.SP3_redhat_00001.1.el8eap
eap7-wildfly
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:7.4.25-2.GA_redhat_00001.1.el8eap
0:7.4.25-2.GA_redhat_00001.1.el8eap
eap7-wildfly-java-jdk11
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:7.4.25-2.GA_redhat_00001.1.el8eap
0:7.4.25-2.GA_redhat_00001.1.el8eap
eap7-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:7.4.25-2.GA_redhat_00001.1.el8eap
0:7.4.25-2.GA_redhat_00001.1.el8eap
eap7-wildfly-java-jdk8
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:7.4.25-2.GA_redhat_00001.1.el8eap
0:7.4.25-2.GA_redhat_00001.1.el8eap
eap7-wildfly-javadocs
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:7.4.25-2.GA_redhat_00001.1.el8eap
0:7.4.25-2.GA_redhat_00001.1.el8eap
eap7-wildfly-modules
Red Hat:jboss_enterprise_application_platform_els:7.4::el8
From an advisory covering 41 CVEs
 before 0:7.4.25-2.GA_redhat_00001.1.el8eap
0:7.4.25-2.GA_redhat_00001.1.el8eap
eap7-activemq-artemis
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-jms-client
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-jms-server
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-ra
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-service-extensions
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-activemq-artemis-tools
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.16.0-22.redhat_00057.1.el9eap
0:2.16.0-22.redhat_00057.1.el9eap
eap7-glassfish-jsf
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:2.3.14-11.SP11_redhat_00001.1.el9eap
0:2.3.14-11.SP11_redhat_00001.1.el9eap
eap7-ironjacamar
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el9eap
0:1.5.26-2.Final_redhat_00001.1.el9eap
eap7-ironjacamar-common-api
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el9eap
0:1.5.26-2.Final_redhat_00001.1.el9eap
eap7-ironjacamar-common-impl
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el9eap
0:1.5.26-2.Final_redhat_00001.1.el9eap
eap7-ironjacamar-common-spi
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el9eap
0:1.5.26-2.Final_redhat_00001.1.el9eap
eap7-ironjacamar-core-api
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el9eap
0:1.5.26-2.Final_redhat_00001.1.el9eap
eap7-ironjacamar-core-impl
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el9eap
0:1.5.26-2.Final_redhat_00001.1.el9eap
eap7-ironjacamar-deployers-common
Red Hat:jboss_enterprise_application_platform_els:7.4::el9
From an advisory covering 41 CVEs
 before 0:1.5.26-2.Final_redhat_00001.1.el9eap
0:1.5.26-2.Final_redhat_00001.1.el9eap
com.fasterxml.jackson.core:jackson-core
Root:Maven
 before 2.21.3-aikido.2
2.21.3-aikido.22.14.2-aikido.42.15.2-aikido.32.17.1-aikido.32.13.0-aikido.22.21.2-aikido.32.12.7-aikido.72.17.2-aikido.52.13.5-aikido.22.18.3-aikido.32.21.4-aikido.12.18.8-aikido.1
tools.jackson.core:jackson-core
Root:Maven
 before 3.1.4-aikido.1
3.1.4-aikido.1
io.root.com.fasterxml.jackson.core:jackson-core
Root:Maven
 before 2.21.3-root.io.2
2.21.3-root.io.22.14.2-root.io.42.15.2-root.io.32.17.1-root.io.32.13.0-root.io.22.21.2-root.io.32.12.7-root.io.72.17.2-root.io.52.13.5-root.io.22.18.3-root.io.32.21.4-root.io.12.18.8-root.io.1
io.root.tools.jackson.core:jackson-core
Root:Maven
 before 3.1.4-root.io.1
3.1.4-root.io.1
com.fasterxml.jackson.core:jackson-core
Root:Maven
 before 2.12.7-aikido.3
2.12.7-aikido.32.12.7-aikido.42.21.3-aikido.12.14.2-aikido.32.15.2-aikido.22.14.3-aikido.32.12.3-aikido.32.12.4-aikido.32.13.2-aikido.42.12.5-aikido.32.13.4-aikido.32.14.1-aikido.32.10.1-aikido.32.22.0-aikido.12.18.6-aikido.12.18.7-aikido.12.17.2-aikido.22.19.4-aikido.22.17.0-aikido.22.17.1-aikido.22.15.3-aikido.32.21.2-aikido.12.19.2-aikido.12.15.0-aikido.12.21.1-aikido.12.13.0-aikido.12.3.1-aikido.12.17.2-aikido.32.21.3-aikido.22.17.2-aikido.42.21.2-aikido.22.14.2-aikido.42.15.2-aikido.32.17.1-aikido.32.13.0-aikido.22.12.7-aikido.52.21.2-aikido.32.12.7-aikido.62.12.7-aikido.72.17.2-aikido.52.13.5-aikido.12.22.0-aikido.22.13.5-aikido.22.18.3-aikido.3
tools.jackson.core:jackson-core
Root:Maven
 before 3.1.1-aikido.1
3.1.1-aikido.13.1.0-aikido.3
io.root.com.fasterxml.jackson.core:jackson-core
Root:Maven
 before 2.12.7-root.io.3
2.12.7-root.io.32.12.7-root.io.42.21.3-root.io.12.14.2-root.io.32.15.2-root.io.22.14.3-root.io.32.12.3-root.io.32.12.4-root.io.32.13.2-root.io.42.12.5-root.io.32.13.4-root.io.32.14.1-root.io.32.10.1-root.io.32.22.0-root.io.12.18.6-root.io.12.18.7-root.io.12.17.2-root.io.22.19.4-root.io.22.17.0-root.io.22.17.1-root.io.22.15.3-root.io.32.21.2-root.io.12.19.2-root.io.12.21.1-root.io.12.15.0-root.io.12.13.0-root.io.12.3.1-root.io.12.17.2-root.io.32.21.3-root.io.22.17.2-root.io.42.21.2-root.io.22.14.2-root.io.42.15.2-root.io.32.17.1-root.io.32.13.0-root.io.22.12.7-root.io.52.21.2-root.io.32.12.7-root.io.62.12.7-root.io.72.17.2-root.io.52.13.5-root.io.12.22.0-root.io.22.13.5-root.io.22.18.3-root.io.3
io.root.tools.jackson.core:jackson-core
Root:Maven
 before 3.1.1-root.io.1
3.1.1-root.io.13.1.0-root.io.3
jackson-annotations
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-annotations
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-core
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.4.2-2
 None known
jackson-core
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.8.6-12.9.1-12.9.4-12.9.8-3~18.04
 None known
jackson-core
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.9.8-32.10.0-12.10.1-1
 None known
jackson-core
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.12.1-12.13.0-12.13.0-2
 None known
jackson-core
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.14.1-1
 None known
jackson-core
Ubuntu:26.10
 All versions, plus listed versions
2.14.1-1build12.14.1-2
 None known
jackson-core
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.14.1-12.14.1-1build1
 None known
jackson-core
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.18.9-2.1
2.18.9-2.1
jackson-annotations
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1

History

History
RecordedChangedSources
affected
affected, factsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-68494 is a high vulnerability (CVSS 8.7) in Fasterxml Jackson-core, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in com.fasterxml.jackson.core:jackson-core 2.18.8.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 472 package rows, 117 versions, 424 references and the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open