CVE-2026-89407
jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9][.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9] run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run.
Matching cost therefore grows with the square of the input length.
An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float).
Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex.
Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool.
The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected.
The fix replaces both regular expressions with a hand-rolled single-pass scan.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9][.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9] run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run.
Matching cost therefore grows with the square of the input length.
An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float).
Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex.
Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool.
The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected.
The fix replaces both regular expressions with a hand-rolled single-pass scan.
- Record
CVE-2026-89407- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333, CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-84498
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9][.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9] run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run.
Matching cost therefore grows with the square of the input length.
An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float).
Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex.
Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool.
The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected.
The fix replaces both regular expressions with a hand-rolled single-pass scan.
- Record
EUVD-2026-84498- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p6pp-m3f8-5c89
jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()
Status
FULLY REPRODUCED with a clean, textbook empirical signature: measured runtime grew almost
exactly 4x for every doubling of input size across five consecutive doublings (5,000 → 160,000
characters), confirming O(n²) behavior. A single 160,000-character string (smaller than a typical
HTTP request body) took 74.4 seconds for one call to NumberInput.looksLikeValidNumber().
Affected Component / Version
- Package:
com.fasterxml.jackson.core:jackson-core - Confirmed against:
jackson-core-2.20.2 - Affected file:
src/main/java/com/fasterxml/jackson/core/io/NumberInput.java(PATTERN_FLOATline ~41-42,PATTERN_FLOAT_TRAILING_DOTline ~51, entry pointlooksLikeValidNumber()lines ~646-656)
Technical Analysis
private final static Pattern PATTERN_FLOAT = Pattern.compile(
"[+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?");
private final static Pattern PATTERN_FLOAT_TRAILING_DOT = Pattern.compile(
"[+-]?[0-9]+[\\.]");
public static boolean looksLikeValidNumber(final String s) {
// ... short-circuits only for null/empty/length==1 ...
return PATTERN_FLOAT.matcher(s).matches()
|| PATTERN_FLOAT_TRAILING_DOT.matcher(s).matches();
}
PATTERN_FLOAT contains ambiguous, adjacent quantifiers over the identical character class:
[0-9]* (optional digits), an optional [.], then [0-9]+ (required digits). Java's
backtracking Pattern/Matcher engine has no possessive quantifiers or atomic grouping here,
so on a non-matching input the engine must explore every possible split point between the
[0-9]* and [0-9]+ groups before concluding failure — the classic quadratic-backtracking
shape. looksLikeValidNumber() compounds the cost by running a second full-string regex
(PATTERN_FLOAT_TRAILING_DOT) whenever the first fails, roughly doubling the constant factor
without changing the asymptotic class.
Critically, the length gate that applies to this specific path is
StreamReadConstraints.maxStringLength (default 20,000,000), not maxNumberLength
(default 1,000) — the length ceiling the library uses everywhere else for numeric content.
This means inputs up to four orders of magnitude larger than the library's own numeric-length
policy reach this quadratic regex unmodified.
Reproduction Procedure
Same clone/build steps as jackson-core_1_...md. Then:
CP="build/classes:build/lib/fastdoubleparser-2.0.1.jar"
javac -cp "$CP" -d poc poc/PoC8_NumberInputReDoS.java
java -cp "poc:$CP" PoC8_NumberInputReDoS
Full PoC Source (poc/PoC8_NumberInputReDoS.java)
import com.fasterxml.jackson.core.io.NumberInput;
public class PoC8_NumberInputReDoS {
public static void main(String[] args) {
int[] sizes = {5_000, 10_000, 20_000, 40_000, 80_000, 160_000};
long[] timesMs = new long[sizes.length];
System.out.println("Timing NumberInput.looksLikeValidNumber(<n ones> + 'x') for growing n:\n");
for (int i = 0; i < sizes.length; i++) {
int n = sizes[i];
String s = repeat('1', n) + "x";
if (i == 0) {
NumberInput.looksLikeValidNumber(repeat('1', 200) + "x"); // warm up
}
long t0 = System.nanoTime();
boolean result = NumberInput.looksLikeValidNumber(s);
long elapsedMs = (System.nanoTime() - t0) / 1_000_000;
timesMs[i] = elapsedMs;
System.out.printf("n=%-8d looksLikeValidNumber=%-6b elapsed=%6d ms%n", n, result, elapsedMs);
}
System.out.println("\nRatio of elapsed time when n doubles (expect ~2x for linear, ~4x for quadratic):");
boolean quadraticSignatureObserved = false;
for (int i = 1; i < sizes.length; i++) {
double ratio = timesMs[i - 1] == 0 ? Double.NaN : (double) timesMs[i] / (double) timesMs[i - 1];
System.out.printf(" n=%d -> n=%d : %dms -> %dms (ratio=%.2fx)%n",
sizes[i -…
- Record
GHSA-p6pp-m3f8-5c89- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-1333
- Updated
- 2026-11-02
NVD
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9][.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9] run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run.
Matching cost therefore grows with the square of the input length.
An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float).
Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex.
Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool.
The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected.
The fix replaces both regular expressions with a hand-rolled single-pass scan.
- Record
CVE-2026-89407- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-1333
- Updated
- 2026-11-02
OSV
jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9][.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9] run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run.
Matching cost therefore grows with the square of the input length.
An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float).
Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex.
Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool.
The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected.
The fix replaces both regular expressions with a hand-rolled single-pass scan.
- Record
CVE-2026-89407- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333, CWE-400
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-89407
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9][.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9] run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. Matching cost therefore grows with the square of the input length. An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. The fix replaces both regular expressions with a hand-rolled single-pass scan.
- Record
DEBIAN-CVE-2026-89407- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 22 moreShow less
OSVGHSA-p6pp-m3f8-5c89
jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()
Status
FULLY REPRODUCED with a clean, textbook empirical signature: measured runtime grew almost
exactly 4x for every doubling of input size across five consecutive doublings (5,000 → 160,000
characters), confirming O(n²) behavior. A single 160,000-character string (smaller than a typical
HTTP request body) took 74.4 seconds for one call to NumberInput.looksLikeValidNumber().
Affected Component / Version
- Package:
com.fasterxml.jackson.core:jackson-core - Confirmed against:
jackson-core-2.20.2 - Affected file:
src/main/java/com/fasterxml/jackson/core/io/NumberInput.java(PATTERN_FLOATline ~41-42,PATTERN_FLOAT_TRAILING_DOTline ~51, entry pointlooksLikeValidNumber()lines ~646-656)
Technical Analysis
private final static Pattern PATTERN_FLOAT = Pattern.compile(
"[+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?");
private final static Pattern PATTERN_FLOAT_TRAILING_DOT = Pattern.compile(
"[+-]?[0-9]+[\\.]");
public static boolean looksLikeValidNumber(final String s) {
// ... short-circuits only for null/empty/length==1 ...
return PATTERN_FLOAT.matcher(s).matches()
|| PATTERN_FLOAT_TRAILING_DOT.matcher(s).matches();
}
PATTERN_FLOAT contains ambiguous, adjacent quantifiers over the identical character class:
[0-9]* (optional digits), an optional [.], then [0-9]+ (required digits). Java's
backtracking Pattern/Matcher engine has no possessive quantifiers or atomic grouping here,
so on a non-matching input the engine must explore every possible split point between the
[0-9]* and [0-9]+ groups before concluding failure — the classic quadratic-backtracking
shape. looksLikeValidNumber() compounds the cost by running a second full-string regex
(PATTERN_FLOAT_TRAILING_DOT) whenever the first fails, roughly doubling the constant factor
without changing the asymptotic class.
Critically, the length gate that applies to this specific path is
StreamReadConstraints.maxStringLength (default 20,000,000), not maxNumberLength
(default 1,000) — the length ceiling the library uses everywhere else for numeric content.
This means inputs up to four orders of magnitude larger than the library's own numeric-length
policy reach this quadratic regex unmodified.
Reproduction Procedure
Same clone/build steps as jackson-core_1_...md. Then:
CP="build/classes:build/lib/fastdoubleparser-2.0.1.jar"
javac -cp "$CP" -d poc poc/PoC8_NumberInputReDoS.java
java -cp "poc:$CP" PoC8_NumberInputReDoS
Full PoC Source (poc/PoC8_NumberInputReDoS.java)
import com.fasterxml.jackson.core.io.NumberInput;
public class PoC8_NumberInputReDoS {
public static void main(String[] args) {
int[] sizes = {5_000, 10_000, 20_000, 40_000, 80_000, 160_000};
long[] timesMs = new long[sizes.length];
System.out.println("Timing NumberInput.looksLikeValidNumber(<n ones> + 'x') for growing n:\n");
for (int i = 0; i < sizes.length; i++) {
int n = sizes[i];
String s = repeat('1', n) + "x";
if (i == 0) {
NumberInput.looksLikeValidNumber(repeat('1', 200) + "x"); // warm up
}
long t0 = System.nanoTime();
boolean result = NumberInput.looksLikeValidNumber(s);
long elapsedMs = (System.nanoTime() - t0) / 1_000_000;
timesMs[i] = elapsedMs;
System.out.printf("n=%-8d looksLikeValidNumber=%-6b elapsed=%6d ms%n", n, result, elapsedMs);
}
System.out.println("\nRatio of elapsed time when n doubles (expect ~2x for linear, ~4x for quadratic):");
boolean quadraticSignatureObserved = false;
for (int i = 1; i < sizes.length; i++) {
double ratio = timesMs[i - 1] == 0 ? Double.NaN : (double) timesMs[i] / (double) timesMs[i - 1];
System.out.printf(" n=%d -> n=%d : %dms -> %dms (ratio=%.2fx)%n",
sizes[i -…
- Record
GHSA-p6pp-m3f8-5c89- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333, CWE-400
- Updated
- 2026-11-02
OSVRLSA-2026:86706
Moderate: jackson-core security update
Core part of Jackson that defines Streaming API as well as basic shared abstractions.
Security Fix(es):
-
com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)
-
com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:86706- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2026:92408
Important: dogtag-pki security update
IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:
- Certificate Authority (CA)
- Key Recovery Authority (KRA)
- Online Certificate Status Protocol (OCSP) Manager
- Token Key Service (TKS)
- Token Processing Service (TPS)
- Automatic Certificate Management Environment (ACME) Responder
- Enrollment over Secure Transport (EST) Responder
Security Fix(es):
-
resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
-
resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)
-
com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:92408- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-89407
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9][.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9] run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. Matching cost therefore grows with the square of the input length. An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. The fix replaces both regular expressions with a hand-rolled single-pass scan.
- Record
UBUNTU-CVE-2026-89407- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2026:86706 No score
Moderate: jackson-core security update
Core part of Jackson that defines Streaming API as well as basic shared abstractions.
Security Fix(es):
- com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)
- com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:86706- Updated
- 2026-11-02
OSVALSA-2026:92408 No score
Important: dogtag-pki security update
IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:
- Certificate Authority (CA)
- Key Recovery Authority (KRA)
- Online Certificate Status Protocol (OCSP) Manager
- Token Key Service (TKS)
- Token Processing Service (TPS)
- Automatic Certificate Management Environment (ACME) Responder
- Enrollment over Secure Transport (EST) Responder
Security Fix(es):
- resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
- resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)
- com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:92408- Updated
- 2026-11-02
OSVCLSA-2026-1791485698 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.17.1-tuxcare.1.
- Record
CLSA-2026-1791485698- Updated
- 2026-11-02
OSVCLSA-2026-1791485784 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-core (4 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 4 CVEs. Fixed in 2.17.3-tuxcare.2.
- Record
CLSA-2026-1791485784- Updated
- 2026-11-02
OSVCLSA-2026-1791486041 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.17.2-tuxcare.2.
- Record
CLSA-2026-1791486041- Updated
- 2026-11-02
OSVCLSA-2026-1792428696 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.21.4-tuxcare.1.
- Record
CLSA-2026-1792428696- Updated
- 2026-11-02
OSVCLSA-2026-1792428704 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.18.8-tuxcare.1.
- Record
CLSA-2026-1792428704- Updated
- 2026-11-02
OSVCLSA-2026-1792428825 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.18.3-tuxcare.1.
- Record
CLSA-2026-1792428825- Updated
- 2026-11-02
OSVCLSA-2026-1792428857 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.18.4.1-tuxcare.1.
- Record
CLSA-2026-1792428857- Updated
- 2026-11-02
OSVCLSA-2026-1793085177 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.20.1-tuxcare.1.
- Record
CLSA-2026-1793085177- Updated
- 2026-11-02
OSVCLSA-2026-1793087700 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.18.0-tuxcare.2.
- Record
CLSA-2026-1793087700- Updated
- 2026-11-02
OSVCLSA-2026-1793196375 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.18.1-tuxcare.2.
- Record
CLSA-2026-1793196375- Updated
- 2026-11-02
OSVCLSA-2026-1793599822 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.21.2-tuxcare.2.
- Record
CLSA-2026-1793599822- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11876-1 No score
jackson-core-2.18.11-1.1 on GA media
These are all security issues fixed in the jackson-core-2.18.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11876-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:22034-1 No score
Security update for jackson-annotations, jackson-core, jackson-databind
This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:
- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856).
- CVE-2026-19032: deserializer for
java.nio.file.Pathresolves attacker-supplied URIs without restricting the URI scheme (bsc#1277883). - CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
- CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).
- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
- CVE-2026-83557: incomplete
PolymorphicTypeValidatordenylist allows for arbitraryComparabledeserialization (bsc#1278008). - CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
- CVE-2026-89425:
UTF8DataInputJsonParser._reportInvalidToken()lacksmaxErrorTokenLengthlimit, which allows for unboundedStringBuildergrowth and can lead to a DoS when malformed tokens are processed (bsc#1282505). - CVE-2026-91776:
TypeDeserializerBase._findDeserializer()caches the resolved deserializer under the raw, attacker- supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491). - CVE-2026-91777: forward-reference completion for
@JsonIdentityInfoobject IDs performs a linear scan of the pending- reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization (bsc#1282492).
Changes for jackson-annotations:
- Update to 2.18.11
Changes for jackson-core:
- Update to 2.18.11
- #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645, CVE-2026-89407)
- #1698: UTF8DataInputJsonParser does not honor maxErrorTokenLength when reporting an unrecognized token (bsc#1282505, CVE-2026-89425)
- #1642: Fix maxDocumentLength bypass in async parser single-feedInput() case [GHSA-2c4j-63jj-9fqr]
- #1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498) of async parser (bsc#1273857, CVE-2026-68494) non-blocking (async) parser (bsc#1273856, CVE-2026-18401)
Changes for jackson-databind:
- Update to 2.18.11
- #6185: Bracket unresolved IPv6 host name in InetSocketAddress serialization
- #6203: Prevent unbounded growth of type id cache in TypeDeserializer (bsc#1282491, CVE-2026-91776)
- #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
- #6099: Resolve classes without initialization in TypeFactory.findClass()
- #6116: Reject non-ASCII digits in InetAddress literal validation
- #6127: Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
- #6129: Limit the supported URL schemes for java.nio.file.Path deserialization (bsc#1277883, CVE-2026-19032)
- #6156: Add java.lang.Comparable in set of unsafe polymorphic base types (bsc#1278008, CVE-2026-83557)
- #6165: Apply number length limits to BigDecimal/BigInteger/ /Double/Float Map keys
- Record
openSUSE-SU-2026:22034-1- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-89407 No score
CVE-2026-89407 in com.fasterxml.jackson.core:jackson-core - Patched by Root
Root has patched CVE-2026-89407 in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-89407- Updated
- 2026-11-05
OSVSUSE-SU-2026:24149-1 No score
Security update for jackson-annotations, jackson-core, jackson-databind
This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:
- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856).
- CVE-2026-19032: deserializer for
java.nio.file.Pathresolves attacker-supplied URIs without restricting the URI scheme (bsc#1277883). - CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
- CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).
- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
- CVE-2026-83557: incomplete
PolymorphicTypeValidatordenylist allows for arbitraryComparabledeserialization (bsc#1278008). - CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
- CVE-2026-89425:
UTF8DataInputJsonParser._reportInvalidToken()lacksmaxErrorTokenLengthlimit, which allows for unboundedStringBuildergrowth and can lead to a DoS when malformed tokens are processed (bsc#1282505). - CVE-2026-91776:
TypeDeserializerBase._findDeserializer()caches the resolved deserializer under the raw, attacker- supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491). - CVE-2026-91777: forward-reference completion for
@JsonIdentityInfoobject IDs performs a linear scan of the pending- reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization (bsc#1282492).
Changes for jackson-annotations:
- Update to 2.18.11
Changes for jackson-core:
- Update to 2.18.11
- #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645, CVE-2026-89407)
- #1698: UTF8DataInputJsonParser does not honor maxErrorTokenLength when reporting an unrecognized token (bsc#1282505, CVE-2026-89425)
- #1642: Fix maxDocumentLength bypass in async parser single-feedInput() case [GHSA-2c4j-63jj-9fqr]
- #1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498) of async parser (bsc#1273857, CVE-2026-68494) non-blocking (async) parser (bsc#1273856, CVE-2026-18401)
Changes for jackson-databind:
- Update to 2.18.11
- #6185: Bracket unresolved IPv6 host name in InetSocketAddress serialization
- #6203: Prevent unbounded growth of type id cache in TypeDeserializer (bsc#1282491, CVE-2026-91776)
- #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
- #6099: Resolve classes without initialization in TypeFactory.findClass()
- #6116: Reject non-ASCII digits in InetAddress literal validation
- #6127: Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
- #6129: Limit the supported URL schemes for java.nio.file.Path deserialization (bsc#1277883, CVE-2026-19032)
- #6156: Add java.lang.Comparable in set of unsafe polymorphic base types (bsc#1278008, CVE-2026-83557)
- #6165: Apply number length limits to BigDecimal/BigInteger/ /Double/Float Map keys
- Record
SUSE-SU-2026:24149-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4394-1 No score
Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues:
- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856).
- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
- CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).
- CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).
- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
- CVE-2026-89425:
UTF8DataInputJsonParser._reportInvalidToken()lacksmaxErrorTokenLengthlimit, which allows for unboundedStringBuildergrowth and can lead to a DoS when malformed tokens are processed (bsc#1282505).
Changes for jackson-annotations:
- Update to 2.18.11
Changes for jackson-bom:
- Update to 2.18.11
Changes for jackson-core:
- Update to 2.18.11
- #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645, CVE-2026-89407)
- #1698: UTF8DataInputJsonParser does not honor maxErrorTokenLength when reporting an unrecognized token (bsc#1282505, CVE-2026-89425)
- #1642: Fix maxDocumentLength bypass in async parser single-feedInput() case [GHSA-2c4j-63jj-9fqr]
- #1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498) of async parser (bsc#1273857, CVE-2026-68494) non-blocking (async) parser (bsc#1273856, CVE-2026-18401)
Changes for jackson-databind:
- Update to 2.18.11
- #6185: Bracket unresolved IPv6 host name in InetSocketAddress serialization
- #6203: Prevent unbounded growth of type id cache in TypeDeserializer (bsc#1282491, CVE-2026-91776)
- #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
- #6099: Resolve classes without initialization in TypeFactory.findClass()
- #6116: Reject non-ASCII digits in InetAddress literal validation
- #6127: Add StreamReadConstraints number len constraint to javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
- #6129: Limit the supported URL schemes for java.nio.file.Path deserialization (bsc#1277883, CVE-2026-19032)
- #6156: Add java.lang.Comparable in set of unsafe polymorphic base types (bsc#1278008, CVE-2026-83557)
- #6165: Apply number length limits to BigDecimal/BigInteger/ /Double/Float Map keys
Changes for jackson-dataformat-xml:
- Update to 2.18.11
- Fix build to avoid past-JDK-8 bytecode generation
- #891: Enforce StreamReadConstraints.maxNestingDepth in FromXmlParser
Changes for jackson-dataformats-binary:
- Update to 2.18.11
- #783: (protobuf) Support StreamReadConstraints.maxDocumentLength in ProtobufParser
- #785: (avro) Support StreamReadConstraints.maxDocumentLength and maxTokenCount in Avro parser
- #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion parser (partial fix for #358)
- #805: (ion) Support StreamReadConstraints.maxDocumentLength in Ion parser (partial fix for #358)
- #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639, CVE-2026-68495)
- #726: (smile) Ensure maxNameLength limit enforced for Smile parser (bsc#1282640, CVE-2026-68496)
- #727: (cbor) CBORParser.nextFieldName(SerializableString) confuses 5-bit length marker 23 with 24 ('1-byte length suffix follows')
- #728: (cbor) CBORParser.nextFieldName(SerializableString) consumes Object entry slot twice on fast-path miss, truncating definite-length Objects
- #733: (cbor) Long
Strings not added to 'stringref' reference table, breaking following references - #735: (cbor) 'stringref' property-name paths pass 5-bit length marker instead of actual length to shouldReferenceString()
- #736: (cbor) Long…
- Record
SUSE-SU-2026:4394-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.fasterxml.jackson.core:jackson-coreMaven |
2.17.0 to 2.18.10 | 2.18.11 |
com.fasterxml.jackson.core:jackson-coreMaven |
2.19.0 to 2.21.6 | 2.21.7 |
com.fasterxml.jackson.core:jackson-coreMaven |
2.22.0 to 2.22.2 | 2.22.3 |
tools.jackson.core:jackson-coreMaven |
3.0.0 to 3.1.6 | 3.1.7 |
tools.jackson.core:jackson-coreMaven |
3.2.0 to 3.2.1 | 3.2.2 |
pki-jackson-coreAlmaLinux:9 From an advisory covering 2 CVEs |
before 2.21.6-1.el9_8.2 | 2.21.6-1.el9_8.2 |
idm-pki-acmeAlmaLinux:10 From an advisory covering 3 CVEs |
before 11.9.0-6.el10_2.1.alma.1 | 11.9.0-6.el10_2.1.alma.1 |
idm-pki-baseAlmaLinux:10 From an advisory covering 3 CVEs |
before 11.9.0-6.el10_2.1.alma.1 | 11.9.0-6.el10_2.1.alma.1 |
idm-pki-caAlmaLinux:10 From an advisory covering 3 CVEs |
before 11.9.0-6.el10_2.1.alma.1 | 11.9.0-6.el10_2.1.alma.1 |
idm-pki-javaAlmaLinux:10 From an advisory covering 3 CVEs |
before 11.9.0-6.el10_2.1.alma.1 | 11.9.0-6.el10_2.1.alma.1 |
Show 101 moreShow less
| Package | Affected | Fixed |
|---|---|---|
idm-pki-kraAlmaLinux:10 From an advisory covering 3 CVEs |
before 11.9.0-6.el10_2.1.alma.1 | 11.9.0-6.el10_2.1.alma.1 |
idm-pki-serverAlmaLinux:10 From an advisory covering 3 CVEs |
before 11.9.0-6.el10_2.1.alma.1 | 11.9.0-6.el10_2.1.alma.1 |
idm-pki-toolsAlmaLinux:10 From an advisory covering 3 CVEs |
before 11.9.0-6.el10_2.1.alma.1 | 11.9.0-6.el10_2.1.alma.1 |
python3-idm-pkiAlmaLinux:10 From an advisory covering 3 CVEs |
before 11.9.0-6.el10_2.1.alma.1 | 11.9.0-6.el10_2.1.alma.1 |
com.fasterxml.jackson.core:jackson-coreTuxCare:Maven From an advisory covering 4 CVEs |
2.17.1 up to 2.17.1-tuxcare.1 | 2.17.1-tuxcare.1 |
com.fasterxml.jackson.core:jackson-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.17.3 up to 2.17.3-tuxcare.2, plus listed versions 2.17.3-tuxcare.1 |
2.17.3-tuxcare.2 |
com.fasterxml.jackson.core:jackson-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.17.2 up to 2.17.2-tuxcare.2, plus listed versions 2.17.2-tuxcare.1 |
2.17.2-tuxcare.2 |
com.fasterxml.jackson.core:jackson-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.21.4 up to 2.21.4-tuxcare.1 | 2.21.4-tuxcare.1 |
com.fasterxml.jackson.core:jackson-coreTuxCare:Maven |
2.18.8 up to 2.18.8-tuxcare.1 | 2.18.8-tuxcare.1 |
com.fasterxml.jackson.core:jackson-coreTuxCare:Maven |
2.18.3 up to 2.18.3-tuxcare.1 | 2.18.3-tuxcare.1 |
com.fasterxml.jackson.core:jackson-coreTuxCare:Maven |
2.18.4.1 up to 2.18.4.1-tuxcare.1 | 2.18.4.1-tuxcare.1 |
com.fasterxml.jackson.core:jackson-coreTuxCare:Maven From an advisory covering 4 CVEs |
2.20.1 up to 2.20.1-tuxcare.1 | 2.20.1-tuxcare.1 |
com.fasterxml.jackson.core:jackson-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.18.0 up to 2.18.0-tuxcare.2, plus listed versions 2.18.0-tuxcare.1 |
2.18.0-tuxcare.2 |
com.fasterxml.jackson.core:jackson-coreTuxCare:Maven |
2.18.1 up to 2.18.1-tuxcare.2, plus listed versions 2.18.1-tuxcare.1 |
2.18.1-tuxcare.2 |
com.fasterxml.jackson.core:jackson-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.21.2 up to 2.21.2-tuxcare.2, plus listed versions 2.21.2-tuxcare.1 |
2.21.2-tuxcare.2 |
jackson-coreDebian:12 |
All versions, plus listed versions 2.14.1-12.14.1-22.14.1-2~deb11u12.14.1-2~deb12u12.14.1-2~deb13u1 |
None known |
jackson-coreDebian:13 |
All versions, plus listed versions 2.14.1-12.14.1-22.14.1-2~deb11u12.14.1-2~deb12u12.14.1-2~deb13u1 |
None known |
jackson-coreDebian:14 |
All versions, plus listed versions 2.14.1-12.14.1-22.14.1-2~deb11u12.14.1-2~deb12u12.14.1-2~deb13u1 |
None known |
com.fasterxml.jackson.core:jackson-coreMaven |
2.17.0 up to 2.18.11, plus listed versions 2.17.12.17.22.17.32.18.02.18.0-rc1 Show 11 moreShow less2.18.12.18.102.18.22.18.32.18.42.18.4.12.18.52.18.62.18.72.18.82.18.9 |
2.18.11 |
com.fasterxml.jackson.core:jackson-coreMaven |
2.19.0 up to 2.21.7, plus listed versions 2.19.12.19.22.19.32.19.42.20.0 Show 10 moreShow less2.20.0-rc12.20.12.20.22.21.02.21.12.21.22.21.32.21.42.21.52.21.6 |
2.21.7 |
com.fasterxml.jackson.core:jackson-coreMaven |
2.22.0 up to 2.22.3, plus listed versions 2.22.12.22.2 |
2.22.3 |
tools.jackson.core:jackson-coreMaven |
3.0.0 up to 3.1.7, plus listed versions 3.0.13.0.23.0.33.0.43.1.0 Show 7 moreShow less3.1.0-rc13.1.13.1.23.1.33.1.43.1.53.1.6 |
3.1.7 |
tools.jackson.core:jackson-coreMaven |
3.2.0 up to 3.2.2, plus listed versions 3.2.1 |
3.2.2 |
jackson-coreRocky Linux:9 From an advisory covering 2 CVEs |
before 0:2.21.6-1.el9_8.2 | 0:2.21.6-1.el9_8.2 |
dogtag-pkiRocky Linux:10 From an advisory covering 3 CVEs |
before 0:11.9.0-6.el10_2.1.rocky.0.1 | 0:11.9.0-6.el10_2.1.rocky.0.1 |
com.fasterxml.jackson.core:jackson-coreRoot:Maven |
before 2.21.3-aikido.2 | 2.21.3-aikido.22.17.2-aikido.42.21.4-aikido.12.18.10-aikido.12.18.9-aikido.12.18.8-aikido.12.21.5-aikido.12.21.2-aikido.22.17.1-aikido.32.21.2-aikido.32.21.6-aikido.12.22.1-aikido.12.22.2-aikido.12.17.2-aikido.52.18.3-aikido.3 |
tools.jackson.core:jackson-coreRoot:Maven |
before 3.1.6-aikido.1 | 3.1.6-aikido.13.1.4-aikido.13.1.5-aikido.1 |
io.root.com.fasterxml.jackson.core:jackson-coreRoot:Maven |
before 2.21.3-root.io.2 | 2.21.3-root.io.22.17.2-root.io.42.21.4-root.io.12.18.10-root.io.12.18.9-root.io.12.18.8-root.io.12.21.5-root.io.12.21.2-root.io.22.17.1-root.io.32.21.2-root.io.32.21.6-root.io.12.22.1-root.io.12.22.2-root.io.12.17.2-root.io.52.18.3-root.io.3 |
io.root.tools.jackson.core:jackson-coreRoot:Maven |
before 3.1.6-root.io.1 | 3.1.6-root.io.13.1.4-root.io.13.1.5-root.io.1 |
jackson-annotationsSUSE:Linux Enterprise Server 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-coreSUSE:Linux Enterprise Server 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-databindSUSE:Linux Enterprise Server 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-annotationsSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-coreSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-databindSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-annotationsSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-coreUbuntu:16.04:LTS |
All versions, plus listed versions 2.4.2-2 |
None known |
jackson-coreUbuntu:18.04:LTS |
All versions, plus listed versions 2.8.6-12.9.1-12.9.4-12.9.8-3~18.04 |
None known |
jackson-coreUbuntu:20.04:LTS |
All versions, plus listed versions 2.9.8-32.10.0-12.10.1-1 |
None known |
jackson-coreUbuntu:22.04:LTS |
All versions, plus listed versions 2.12.1-12.13.0-12.13.0-2 |
None known |
jackson-coreUbuntu:24.04:LTS |
All versions, plus listed versions 2.14.1-1 |
None known |
jackson-coreUbuntu:26.10 |
All versions, plus listed versions 2.14.1-1build12.14.1-2 |
None known |
jackson-coreUbuntu:26.04:LTS |
All versions, plus listed versions 2.14.1-12.14.1-1build1 |
None known |
jackson-coreopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 2.18.11-1.1 | 2.18.11-1.1 |
jackson-annotationsopenSUSE:Leap 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-coreopenSUSE:Leap 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-databindopenSUSE:Leap 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-89407 is a high vulnerability (CVSS 7.5) in Fasterxml Jackson-core, published September 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in com.fasterxml.jackson.core:jackson-core 2.18.11.
References
github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89
nvd.nist.gov/vuln/detail/CVE-2026-89407
Show 52 moreShow less
access.redhat.com/errata/RHSA-2026:86706
bugzilla.redhat.com/2538720
errata.almalinux.org/9/ALSA-2026-86706.html
repo1.maven.org/maven2
security-tracker.debian.org/tracker/CVE-2026-89407
errata.rockylinux.org/RLSA-2026:86706
suse.com/support/update/announcement/2026/suse-su-202624149-1
bugzilla.suse.com/1273856
ubuntu.com/security/CVE-2026-89407
cve.org/CVERecord?id=CVE-2026-89407
Left out here: the rest of 3 source descriptions. The JSON record has them.