Every CVE Search/ Get API key

CVE-2026-68498

jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service

7.5 HighFix available

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.

In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.

A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.

Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.

This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.65%Down 0.3 points since Oct 17, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.

In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.

A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.

Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.

This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.

Record
CVE-2026-68498
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2026-103177 7.5

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.

In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.

A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.

Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.

This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.

Record
EUVD-2026-103177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
NVD 7.5

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.

In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.

A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.

Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.

This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.

Record
CVE-2026-68498
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSV 7.5

jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.

In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.

A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.

Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.

This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.

Record
CVE-2026-68498
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-06
OSVDEBIAN-CVE-2026-68498 7.5

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default. In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory. A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration. Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes. This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.

Record
DEBIAN-CVE-2026-68498
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:90909 7.5

Important: pki-deps:10.6 security update

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.

Security Fix(es):

  • com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)

  • com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)

  • com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:90909
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2026-68498 7.5

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default. In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory. A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration. Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes. This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.

Record
UBUNTU-CVE-2026-68498
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:90909 No score

Important: pki-deps:10.6 security update

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

Security Fix(es):

  • com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)
  • com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)
  • com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:90909
Updated
2026-11-02
OSVopenSUSE-SU-2026:11876-1 No score

jackson-core-2.18.11-1.1 on GA media

These are all security issues fixed in the jackson-core-2.18.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11876-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22034-1 No score

Security update for jackson-annotations, jackson-core, jackson-databind

This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:

  • CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856).
  • CVE-2026-19032: deserializer for java.nio.file.Path resolves attacker-supplied URIs without restricting the URI scheme (bsc#1277883).
  • CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
  • CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).
  • CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
  • CVE-2026-83557: incomplete PolymorphicTypeValidator denylist allows for arbitrary Comparable deserialization (bsc#1278008).
  • CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
  • CVE-2026-89425: UTF8DataInputJsonParser._reportInvalidToken()lacks maxErrorTokenLength limit, which allows for unbounded StringBuilder growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).
  • CVE-2026-91776: TypeDeserializerBase._findDeserializer() caches the resolved deserializer under the raw, attacker- supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).
  • CVE-2026-91777: forward-reference completion for @JsonIdentityInfo object IDs performs a linear scan of the pending- reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization (bsc#1282492).

Changes for jackson-annotations:

  • Update to 2.18.11

Changes for jackson-core:

  • Update to 2.18.11
  • #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645, CVE-2026-89407)
  • #1698: UTF8DataInputJsonParser does not honor maxErrorTokenLength when reporting an unrecognized token (bsc#1282505, CVE-2026-89425)
  • #1642: Fix maxDocumentLength bypass in async parser single-feedInput() case [GHSA-2c4j-63jj-9fqr]
  • #1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498) of async parser (bsc#1273857, CVE-2026-68494) non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

Changes for jackson-databind:

  • Update to 2.18.11
  • #6185: Bracket unresolved IPv6 host name in InetSocketAddress serialization
  • #6203: Prevent unbounded growth of type id cache in TypeDeserializer (bsc#1282491, CVE-2026-91776)
  • #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
  • #6099: Resolve classes without initialization in TypeFactory.findClass()
  • #6116: Reject non-ASCII digits in InetAddress literal validation
  • #6127: Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
  • #6129: Limit the supported URL schemes for java.nio.file.Path deserialization (bsc#1277883, CVE-2026-19032)
  • #6156: Add java.lang.Comparable in set of unsafe polymorphic base types (bsc#1278008, CVE-2026-83557)
  • #6165: Apply number length limits to BigDecimal/BigInteger/ /Double/Float Map keys
Record
openSUSE-SU-2026:22034-1
Updated
2026-11-02
OSVSUSE-SU-2026:24149-1 No score

Security update for jackson-annotations, jackson-core, jackson-databind

This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:

  • CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856).
  • CVE-2026-19032: deserializer for java.nio.file.Path resolves attacker-supplied URIs without restricting the URI scheme (bsc#1277883).
  • CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
  • CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).
  • CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
  • CVE-2026-83557: incomplete PolymorphicTypeValidator denylist allows for arbitrary Comparable deserialization (bsc#1278008).
  • CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
  • CVE-2026-89425: UTF8DataInputJsonParser._reportInvalidToken()lacks maxErrorTokenLength limit, which allows for unbounded StringBuilder growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).
  • CVE-2026-91776: TypeDeserializerBase._findDeserializer() caches the resolved deserializer under the raw, attacker- supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).
  • CVE-2026-91777: forward-reference completion for @JsonIdentityInfo object IDs performs a linear scan of the pending- reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization (bsc#1282492).

Changes for jackson-annotations:

  • Update to 2.18.11

Changes for jackson-core:

  • Update to 2.18.11
  • #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645, CVE-2026-89407)
  • #1698: UTF8DataInputJsonParser does not honor maxErrorTokenLength when reporting an unrecognized token (bsc#1282505, CVE-2026-89425)
  • #1642: Fix maxDocumentLength bypass in async parser single-feedInput() case [GHSA-2c4j-63jj-9fqr]
  • #1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498) of async parser (bsc#1273857, CVE-2026-68494) non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

Changes for jackson-databind:

  • Update to 2.18.11
  • #6185: Bracket unresolved IPv6 host name in InetSocketAddress serialization
  • #6203: Prevent unbounded growth of type id cache in TypeDeserializer (bsc#1282491, CVE-2026-91776)
  • #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
  • #6099: Resolve classes without initialization in TypeFactory.findClass()
  • #6116: Reject non-ASCII digits in InetAddress literal validation
  • #6127: Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
  • #6129: Limit the supported URL schemes for java.nio.file.Path deserialization (bsc#1277883, CVE-2026-19032)
  • #6156: Add java.lang.Comparable in set of unsafe polymorphic base types (bsc#1278008, CVE-2026-83557)
  • #6165: Apply number length limits to BigDecimal/BigInteger/ /Double/Float Map keys
Record
SUSE-SU-2026:24149-1
Updated
2026-11-02
OSVSUSE-SU-2026:4394-1 No score

Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues:

  • CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856).
  • CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
  • CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).
  • CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).
  • CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
  • CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
  • CVE-2026-89425: UTF8DataInputJsonParser._reportInvalidToken()lacks maxErrorTokenLength limit, which allows for unbounded StringBuilder growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).

Changes for jackson-annotations:

  • Update to 2.18.11

Changes for jackson-bom:

  • Update to 2.18.11

Changes for jackson-core:

  • Update to 2.18.11
  • #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645, CVE-2026-89407)
  • #1698: UTF8DataInputJsonParser does not honor maxErrorTokenLength when reporting an unrecognized token (bsc#1282505, CVE-2026-89425)
  • #1642: Fix maxDocumentLength bypass in async parser single-feedInput() case [GHSA-2c4j-63jj-9fqr]
  • #1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498) of async parser (bsc#1273857, CVE-2026-68494) non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

Changes for jackson-databind:

  • Update to 2.18.11
  • #6185: Bracket unresolved IPv6 host name in InetSocketAddress serialization
  • #6203: Prevent unbounded growth of type id cache in TypeDeserializer (bsc#1282491, CVE-2026-91776)
  • #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
  • #6099: Resolve classes without initialization in TypeFactory.findClass()
  • #6116: Reject non-ASCII digits in InetAddress literal validation
  • #6127: Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
  • #6129: Limit the supported URL schemes for java.nio.file.Path deserialization (bsc#1277883, CVE-2026-19032)
  • #6156: Add java.lang.Comparable in set of unsafe polymorphic base types (bsc#1278008, CVE-2026-83557)
  • #6165: Apply number length limits to BigDecimal/BigInteger/ /Double/Float Map keys

Changes for jackson-dataformat-xml:

  • Update to 2.18.11
  • Fix build to avoid past-JDK-8 bytecode generation
  • #891: Enforce StreamReadConstraints.maxNestingDepth in FromXmlParser

Changes for jackson-dataformats-binary:

  • Update to 2.18.11
  • #783: (protobuf) Support StreamReadConstraints.maxDocumentLength in ProtobufParser
  • #785: (avro) Support StreamReadConstraints.maxDocumentLength and maxTokenCount in Avro parser
  • #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion parser (partial fix for #358)
  • #805: (ion) Support StreamReadConstraints.maxDocumentLength in Ion parser (partial fix for #358)
  • #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639, CVE-2026-68495)
  • #726: (smile) Ensure maxNameLength limit enforced for Smile parser (bsc#1282640, CVE-2026-68496)
  • #727: (cbor) CBORParser.nextFieldName(SerializableString) confuses 5-bit length marker 23 with 24 ('1-byte length suffix follows')
  • #728: (cbor) CBORParser.nextFieldName(SerializableString) consumes Object entry slot twice on fast-path miss, truncating definite-length Objects
  • #733: (cbor) Long Strings not added to 'stringref' reference table, breaking following references
  • #735: (cbor) 'stringref' property-name paths pass 5-bit length marker instead of actual length to shouldReferenceString()
  • #736: (cbor) Long…
Record
SUSE-SU-2026:4394-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache-commons-collections
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3.2.2-10.module_el8.5.0+2577+9e95fe00
3.2.2-10.module_el8.5.0+2577+9e95fe00
apache-commons-lang
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.6-21.module_el8.5.0+2577+9e95fe00
2.6-21.module_el8.5.0+2577+9e95fe00
apache-commons-net
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3.6-3.module_el8.5.0+2577+9e95fe00
3.6-3.module_el8.5.0+2577+9e95fe00
bea-stax-api
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.2.0-16.module_el8.5.0+2577+9e95fe00
1.2.0-16.module_el8.5.0+2577+9e95fe00
glassfish-fastinfoset
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.2.13-9.module_el8.5.0+2577+9e95fe00
1.2.13-9.module_el8.5.0+2577+9e95fe00
glassfish-jaxb-api
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.2.12-8.module_el8.5.0+2577+9e95fe00
2.2.12-8.module_el8.5.0+2577+9e95fe00
glassfish-jaxb-core
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.2.11-12.module_el8.10.0+3791+e0637953
2.2.11-12.module_el8.10.0+3791+e0637953
glassfish-jaxb-runtime
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.2.11-12.module_el8.10.0+3791+e0637953
2.2.11-12.module_el8.10.0+3791+e0637953
glassfish-jaxb-txw2
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.2.11-12.module_el8.10.0+3791+e0637953
2.2.11-12.module_el8.10.0+3791+e0637953
jackson-annotations
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.21-1.module_el8.10.0+4235+0924958e
2.21-1.module_el8.10.0+4235+0924958e
Show 155 moreShow less
Affected packages
PackageAffectedFixed
jackson-core
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.21.4-1.module_el8.10.0+4329+908ad137.3
2.21.4-1.module_el8.10.0+4329+908ad137.3
jackson-databind
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.21.4-1.module_el8.10.0+4329+908ad137.1
2.21.4-1.module_el8.10.0+4329+908ad137.1
jackson-jaxrs-json-provider
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.21.4-1.module_el8.10.0+4235+0924958e
2.21.4-1.module_el8.10.0+4235+0924958e
jackson-jaxrs-providers
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.21.4-1.module_el8.10.0+4235+0924958e
2.21.4-1.module_el8.10.0+4235+0924958e
jackson-module-jaxb-annotations
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.21.4-2.module_el8.10.0+4235+0924958e
2.21.4-2.module_el8.10.0+4235+0924958e
jakarta-commons-httpclient
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:3.1-28.module_el8.5.0+2577+9e95fe00
1:3.1-28.module_el8.5.0+2577+9e95fe00
javassist
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3.18.1-8.module_el8.5.0+2577+9e95fe00
3.18.1-8.module_el8.5.0+2577+9e95fe00
javassist-javadoc
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3.18.1-8.module_el8.5.0+2577+9e95fe00
3.18.1-8.module_el8.5.0+2577+9e95fe00
pki-servlet-engine
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:9.0.62-1.module_el8.10.0+3791+e0637953
1:9.0.62-1.module_el8.10.0+3791+e0637953
relaxngDatatype
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2011.1-7.module_el8.5.0+2577+9e95fe00
2011.1-7.module_el8.5.0+2577+9e95fe00
slf4j
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.7.25-4.module_el8.5.0+2577+9e95fe00
1.7.25-4.module_el8.5.0+2577+9e95fe00
slf4j-jdk14
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.7.25-4.module_el8.5.0+2577+9e95fe00
1.7.25-4.module_el8.5.0+2577+9e95fe00
stax-ex
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.7.7-8.module_el8.5.0+2577+9e95fe00
1.7.7-8.module_el8.5.0+2577+9e95fe00
velocity
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.7-24.module_el8.5.0+2577+9e95fe00
1.7-24.module_el8.5.0+2577+9e95fe00
xalan-j2
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.7.1-38.module_el8.5.0+2577+9e95fe00
2.7.1-38.module_el8.5.0+2577+9e95fe00
xerces-j2
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.11.0-34.module_el8.5.0+2577+9e95fe00
2.11.0-34.module_el8.5.0+2577+9e95fe00
xml-commons-apis
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.4.01-25.module_el8.5.0+2577+9e95fe00
1.4.01-25.module_el8.5.0+2577+9e95fe00
xml-commons-resolver
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.2-26.module_el8.5.0+2577+9e95fe00
1.2-26.module_el8.5.0+2577+9e95fe00
xmlstreambuffer
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.5.4-8.module_el8.5.0+2577+9e95fe00
1.5.4-8.module_el8.5.0+2577+9e95fe00
xsom
AlmaLinux:8
From an advisory covering 3 CVEs
 before 0-19.20110809svn.module_el8.5.0+2577+9e95fe00
0-19.20110809svn.module_el8.5.0+2577+9e95fe00
jackson-core
Debian:12
 All versions, plus listed versions
2.14.1-12.14.1-22.14.1-2~deb11u12.14.1-2~deb12u12.14.1-2~deb13u12.18.11-12.22.4-1
 None known
jackson-core
Debian:13
 All versions, plus listed versions
2.14.1-12.14.1-22.14.1-2~deb11u12.14.1-2~deb12u12.14.1-2~deb13u12.18.11-12.22.4-1
 None known
jackson-core
Debian:14
 before 2.18.11-1, plus listed versions
2.14.1-12.14.1-22.14.1-2~deb11u12.14.1-2~deb12u12.14.1-2~deb13u1
2.18.11-1
apache-commons-collections
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.2.2-10.module+el8.10.0+1763+c7c02164
0:3.2.2-10.module+el8.10.0+1763+c7c02164
apache-commons-collections
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.2.2-10.module+el8.10.0+2052+1b0fb438
0:3.2.2-10.module+el8.10.0+2052+1b0fb438
apache-commons-collections
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.2.2-10.module+el8.3.0+74+855e3f5d
0:3.2.2-10.module+el8.3.0+74+855e3f5d
apache-commons-lang
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.6-21.module+el8.10.0+1763+c7c02164
0:2.6-21.module+el8.10.0+1763+c7c02164
apache-commons-lang
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.6-21.module+el8.3.0+74+855e3f5d
0:2.6-21.module+el8.3.0+74+855e3f5d
apache-commons-net
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.6-3.module+el8.10.0+1763+c7c02164
0:3.6-3.module+el8.10.0+1763+c7c02164
apache-commons-net
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.6-3.module+el8.10.0+2052+1b0fb438
0:3.6-3.module+el8.10.0+2052+1b0fb438
apache-commons-net
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.6-3.module+el8.3.0+74+855e3f5d
0:3.6-3.module+el8.3.0+74+855e3f5d
bea-stax
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2.0-16.module+el8.10.0+1763+c7c02164
0:1.2.0-16.module+el8.10.0+1763+c7c02164
bea-stax
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2.0-16.module+el8.10.0+2052+1b0fb438
0:1.2.0-16.module+el8.10.0+2052+1b0fb438
glassfish-fastinfoset
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2.13-9.module+el8.10.0+1763+c7c02164
0:1.2.13-9.module+el8.10.0+1763+c7c02164
glassfish-fastinfoset
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2.13-9.module+el8.10.0+2052+1b0fb438
0:1.2.13-9.module+el8.10.0+2052+1b0fb438
glassfish-jaxb
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.2.11-12.module+el8.10.0+1763+c7c02164
0:2.2.11-12.module+el8.10.0+1763+c7c02164
glassfish-jaxb
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.2.11-12.module+el8.10.0+2052+1b0fb438
0:2.2.11-12.module+el8.10.0+2052+1b0fb438
glassfish-jaxb-api
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.2.12-8.module+el8.10.0+1763+c7c02164
0:2.2.12-8.module+el8.10.0+1763+c7c02164
glassfish-jaxb-api
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.2.12-8.module+el8.10.0+2052+1b0fb438
0:2.2.12-8.module+el8.10.0+2052+1b0fb438
jackson-annotations
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21-1.module+el8.10.0+40260+021059e6
0:2.21-1.module+el8.10.0+40260+021059e6
jackson-core
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21.4-1.module+el8.10.0+40260+021059e6
0:2.21.4-1.module+el8.10.0+40260+021059e6
jackson-core
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.3
0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.3
jackson-databind
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.1
0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.1
jackson-databind
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21.4-1.module+el8.10.0+40260+021059e6
0:2.21.4-1.module+el8.10.0+40260+021059e6
jackson-jaxrs-providers
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21.4-1.module+el8.10.0+40260+021059e6
0:2.21.4-1.module+el8.10.0+40260+021059e6
jackson-modules-base
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21.4-2.module+el8.10.0+40260+021059e6
0:2.21.4-2.module+el8.10.0+40260+021059e6
jakarta-commons-httpclient
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:3.1-28.module+el8.10.0+1763+c7c02164
1:3.1-28.module+el8.10.0+1763+c7c02164
jakarta-commons-httpclient
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:3.1-28.module+el8.10.0+2052+1b0fb438
1:3.1-28.module+el8.10.0+2052+1b0fb438
jakarta-commons-httpclient
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:3.1-28.module+el8.3.0+74+855e3f5d
1:3.1-28.module+el8.3.0+74+855e3f5d
javassist
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.18.1-8.module+el8.10.0+1763+c7c02164
0:3.18.1-8.module+el8.10.0+1763+c7c02164
javassist
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.18.1-8.module+el8.10.0+2052+1b0fb438
0:3.18.1-8.module+el8.10.0+2052+1b0fb438
javassist
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.18.1-8.module+el8.3.0+74+855e3f5d
0:3.18.1-8.module+el8.3.0+74+855e3f5d
pki-servlet-engine
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:9.0.62-1.module+el8.10.0+1767+f923f786
1:9.0.62-1.module+el8.10.0+1767+f923f786
pki-servlet-engine
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:9.0.62-1.module+el8.10.0+2052+1b0fb438
1:9.0.62-1.module+el8.10.0+2052+1b0fb438
relaxngDatatype
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2011.1-7.module+el8.10.0+1763+c7c02164
0:2011.1-7.module+el8.10.0+1763+c7c02164
relaxngDatatype
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2011.1-7.module+el8.10.0+2052+1b0fb438
0:2011.1-7.module+el8.10.0+2052+1b0fb438
slf4j
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.25-4.module+el8.10.0+1763+c7c02164
0:1.7.25-4.module+el8.10.0+1763+c7c02164
slf4j
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.25-4.module+el8.10.0+2052+1b0fb438
0:1.7.25-4.module+el8.10.0+2052+1b0fb438
slf4j
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.25-4.module+el8.6.0+843+5a13dac3
0:1.7.25-4.module+el8.6.0+843+5a13dac3
slf4j
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.25-4.module+el8.3.0+74+855e3f5d
0:1.7.25-4.module+el8.3.0+74+855e3f5d
slf4j
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.25-4.module+el8.10.0+2003+8aeac9cb
0:1.7.25-4.module+el8.10.0+2003+8aeac9cb
stax-ex
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.7-8.module+el8.10.0+1763+c7c02164
0:1.7.7-8.module+el8.10.0+1763+c7c02164
stax-ex
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.7-8.module+el8.10.0+2052+1b0fb438
0:1.7.7-8.module+el8.10.0+2052+1b0fb438
velocity
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7-24.module+el8.10.0+1763+c7c02164
0:1.7-24.module+el8.10.0+1763+c7c02164
velocity
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7-24.module+el8.10.0+2052+1b0fb438
0:1.7-24.module+el8.10.0+2052+1b0fb438
velocity
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7-24.module+el8.3.0+74+855e3f5d
0:1.7-24.module+el8.3.0+74+855e3f5d
xalan-j2
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.7.1-38.module+el8.10.0+1763+c7c02164
0:2.7.1-38.module+el8.10.0+1763+c7c02164
xalan-j2
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.7.1-38.module+el8.10.0+2052+1b0fb438
0:2.7.1-38.module+el8.10.0+2052+1b0fb438
xalan-j2
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.7.1-38.module+el8.3.0+74+855e3f5d
0:2.7.1-38.module+el8.3.0+74+855e3f5d
xerces-j2
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.11.0-34.module+el8.10.0+1763+c7c02164
0:2.11.0-34.module+el8.10.0+1763+c7c02164
xerces-j2
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.11.0-34.module+el8.10.0+2052+1b0fb438
0:2.11.0-34.module+el8.10.0+2052+1b0fb438
xerces-j2
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.11.0-34.module+el8.3.0+74+855e3f5d
0:2.11.0-34.module+el8.3.0+74+855e3f5d
xml-commons-apis
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.4.01-25.module+el8.10.0+1763+c7c02164
0:1.4.01-25.module+el8.10.0+1763+c7c02164
xml-commons-apis
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.4.01-25.module+el8.10.0+2052+1b0fb438
0:1.4.01-25.module+el8.10.0+2052+1b0fb438
xml-commons-apis
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.4.01-25.module+el8.10.0+2003+8aeac9cb
0:1.4.01-25.module+el8.10.0+2003+8aeac9cb
xml-commons-apis
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.4.01-25.module+el8.3.0+74+855e3f5d
0:1.4.01-25.module+el8.3.0+74+855e3f5d
xml-commons-resolver
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2-26.module+el8.10.0+2052+1b0fb438
0:1.2-26.module+el8.10.0+2052+1b0fb438
xml-commons-resolver
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2-26.module+el8.10.0+1763+c7c02164
0:1.2-26.module+el8.10.0+1763+c7c02164
xml-commons-resolver
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2-26.module+el8.3.0+74+855e3f5d
0:1.2-26.module+el8.3.0+74+855e3f5d
xmlstreambuffer
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.5.4-8.module+el8.10.0+1763+c7c02164
0:1.5.4-8.module+el8.10.0+1763+c7c02164
xmlstreambuffer
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.5.4-8.module+el8.10.0+2052+1b0fb438
0:1.5.4-8.module+el8.10.0+2052+1b0fb438
xsom
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:0-19.20110809svn.module+el8.10.0+1763+c7c02164
0:0-19.20110809svn.module+el8.10.0+1763+c7c02164
xsom
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:0-19.20110809svn.module+el8.10.0+2052+1b0fb438
0:0-19.20110809svn.module+el8.10.0+2052+1b0fb438
jackson-annotations
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-annotations
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-core
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.4.2-2
 None known
jackson-core
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.8.6-12.9.1-12.9.4-12.9.8-3~18.04
 None known
jackson-core
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.9.8-32.10.0-12.10.1-1
 None known
jackson-core
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.12.1-12.13.0-12.13.0-2
 None known
jackson-core
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.14.1-1
 None known
jackson-core
Ubuntu:26.10
 All versions, plus listed versions
2.14.1-1build12.14.1-2
 None known
jackson-core
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.14.1-12.14.1-1build1
 None known
jackson-core
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 2.18.11-1.1
2.18.11-1.1
jackson-annotations
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1

History

History
RecordedChangedSources
affectedOSV
factsOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-68498 is a high vulnerability (CVSS 7.5) in Fasterxml Jackson-core, published September 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in jackson-core 2.18.11-1.

References

Show 44 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open