{"id":"CVE-2026-68498","aliases":["ALSA-2026:90909","DEBIAN-CVE-2026-68498","EUVD-2026-103177","GHSA-649p-m576-vr99","RLSA-2026:90909","SUSE-SU-2026:24149-1","SUSE-SU-2026:4394-1","UBUNTU-CVE-2026-68498","openSUSE-SU-2026:11876-1","openSUSE-SU-2026:22034-1"],"status":"published","title":"jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service","description":"StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.\n\n\n\nIn the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.\n\n\n\nA remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.\n\n\n\nByte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00652,"percentile":0.51572,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-09-24T00:00:00Z","modified":"2026-11-06T01:07:19Z","fixes":[{"ecosystem":"Debian:14","package":"jackson-core","fixed_in":["2.18.11-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-10.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-21.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apache-commons-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-3.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bea-stax-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-16.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-fastinfoset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-9.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-jaxb-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-jaxb-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-12.module_el8.10.0+3791+e0637953"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-jaxb-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-12.module_el8.10.0+3791+e0637953"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-jaxb-txw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-12.module_el8.10.0+3791+e0637953"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-1.module_el8.10.0+4235+0924958e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4329+908ad137.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4329+908ad137.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-jaxrs-json-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4235+0924958e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-jaxrs-providers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4235+0924958e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-module-jaxb-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-2.module_el8.10.0+4235+0924958e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"javassist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"javassist-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pki-servlet-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-1.module_el8.10.0+3791+e0637953"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"relaxngDatatype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2011.1-7.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.25-4.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slf4j-jdk14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.25-4.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"stax-ex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7-24.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-38.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-34.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.01-25.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xml-commons-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-26.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xmlstreambuffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xsom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-19.20110809svn.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1","2.14.1-2","2.14.1-2~deb11u1","2.14.1-2~deb12u1","2.14.1-2~deb13u1","2.18.11-1","2.22.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1","2.14.1-2","2.14.1-2~deb11u1","2.14.1-2~deb12u1","2.14.1-2~deb13u1","2.18.11-1","2.22.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-1"}]}],"versions":["2.14.1-1","2.14.1-2","2.14.1-2~deb11u1","2.14.1-2~deb12u1","2.14.1-2~deb13u1"]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-10.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-10.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-10.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6-21.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6-21.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-3.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-3.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-3.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-16.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-16.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-fastinfoset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-9.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-fastinfoset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-9.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-jaxb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.11-12.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-jaxb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.11-12.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-jaxb-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.12-8.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-jaxb-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.12-8.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21-1.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-jaxrs-providers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-modules-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-2.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"javassist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.1-8.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"javassist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.1-8.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"javassist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.1-8.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pki-servlet-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-1.module+el8.10.0+1767+f923f786"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pki-servlet-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-1.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"relaxngDatatype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2011.1-7.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"relaxngDatatype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2011.1-7.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.6.0+843+5a13dac3"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.10.0+2003+8aeac9cb"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"stax-ex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.7-8.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"stax-ex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.7-8.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7-24.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7-24.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7-24.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-38.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-38.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-38.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-34.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-34.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-34.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.01-25.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.01-25.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.01-25.module+el8.10.0+2003+8aeac9cb"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.01-25.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2-26.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2-26.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2-26.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xmlstreambuffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-8.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xmlstreambuffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-8.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xsom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0-19.20110809svn.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xsom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0-19.20110809svn.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.6-1","2.9.1-1","2.9.4-1","2.9.8-3~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.8-3","2.10.0-1","2.10.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-1","2.13.0-1","2.13.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1build1","2.14.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1","2.14.1-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10}],"products":[{"vendor":"fasterxml","product":"jackson-core"}],"references":[{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-649p-m576-vr99","tags":["vendor-advisory","advisory","report"]},{"url":"https://github.com/FasterXML/jackson-core/pull/1643","tags":["patch","fix","report"]},{"url":"https://github.com/FasterXML/jackson-core/commit/2cd206de1163e3fcff7bdaca425274f00668b075","tags":["patch","fix"]},{"url":"https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x","tags":["release-notes","advisory"]},{"url":"https://github.com/FasterXML/jackson-core/blob/3.x/release-notes/VERSION","tags":["release-notes","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90909","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-68498","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89425","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-91777","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539084","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539085","tags":["report"]},{"url":"https://bugzilla.redhat.com/2554486","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-90909.html","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68498.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68498","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-core","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-68498","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90909","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554486","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624149-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273856","tags":["report"]},{"url":"https://bugzilla.suse.com/1273857","tags":["report"]},{"url":"https://bugzilla.suse.com/1277883","tags":["report"]},{"url":"https://bugzilla.suse.com/1278008","tags":["report"]},{"url":"https://bugzilla.suse.com/1280125","tags":["report"]},{"url":"https://bugzilla.suse.com/1282491","tags":["report"]},{"url":"https://bugzilla.suse.com/1282492","tags":["report"]},{"url":"https://bugzilla.suse.com/1282505","tags":["report"]},{"url":"https://bugzilla.suse.com/1282641","tags":["report"]},{"url":"https://bugzilla.suse.com/1282645","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-83557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91777","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264394-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282639","tags":["report"]},{"url":"https://bugzilla.suse.com/1282640","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68496","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-68498","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68498","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-68498","title":"jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service","description":"StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.\n\n\n\nIn the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.\n\n\n\nA remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.\n\n\n\nByte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.","status":"published","published":"2026-10-16T21:11:03.551Z","modified":"2026-10-20T18:08:01.96Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:46:10.323375Z"}],"euvd":[{"id":"EUVD-2026-103177","description":"StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.\n\n\n\nIn the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.\n\n\n\nA remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.\n\n\n\nByte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.","status":"published","published":"2026-10-16T21:11:03Z","modified":"2026-10-20T18:08:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:43.145678Z"}],"nvd":[{"id":"CVE-2026-68498","description":"StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.\n\n\n\nIn the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.\n\n\n\nA remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.\n\n\n\nByte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.","status":"published","published":"2026-10-16T22:17:25.183Z","modified":"2026-10-20T19:17:40.12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:13:00.123071Z"}],"osv":[{"id":"CVE-2026-68498","title":"jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service","description":"StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.\n\n\n\nIn the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.\n\n\n\nA remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.\n\n\n\nByte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.\n\n\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.","status":"published","published":"2026-10-16T21:11:03.551Z","modified":"2026-11-06T01:07:19.704022907Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-06T01:32:47.895286Z"},{"id":"DEBIAN-CVE-2026-68498","description":"StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.    In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.    A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.    Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.    This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.","status":"published","published":"2026-10-16T22:17:25.183Z","modified":"2026-10-23T18:04:38.687609209Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"RLSA-2026:90909","title":"Important: pki-deps:10.6 security update","description":"The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.\n\nSecurity Fix(es):\n\n* com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)\n\n* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)\n\n* com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:01:16.697685Z","modified":"2026-10-29T12:30:03.191240243Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-68498","description":"StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default. In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory. A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration. Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes. This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.","status":"published","published":"2026-10-16T22:17:00Z","modified":"2026-10-28T20:17:48.218543643Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"ALSA-2026:90909","title":"Important: pki-deps:10.6 security update","description":"The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.  \n\nSecurity Fix(es):  \n\n  * com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)\n  * com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)\n  * com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-29T11:02:25.387689752Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"openSUSE-SU-2026:11876-1","title":"jackson-core-2.18.11-1.1 on GA media","description":"These are all security issues fixed in the jackson-core-2.18.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-25T18:23:08.65363617Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22034-1","title":"Security update for jackson-annotations, jackson-core, jackson-databind","description":"This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:\n\n- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues\n  (bsc#1273856).\n- CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without restricting the URI\n  scheme (bsc#1277883).\n- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).\n- CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).\n- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).\n- CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable` deserialization\n  (bsc#1278008).\n- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).\n- CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for\n  unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).\n- CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the raw, attacker-\n  supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).\n- CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan of the pending-\n  reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization\n  (bsc#1282492).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.11\n\nChanges for jackson-core:\n\n- Update to 2.18.11\n * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,\n CVE-2026-89407)\n * #1698: UTF8DataInputJsonParser does not honor\n maxErrorTokenLength when reporting an unrecognized token\n (bsc#1282505, CVE-2026-89425)\n * #1642: Fix maxDocumentLength bypass in async parser\n single-feedInput() case [GHSA-2c4j-63jj-9fqr]\n * #1643: Enforce maxNameLength incrementally in\n ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)\n of async parser (bsc#1273857, CVE-2026-68494)\n non-blocking (async) parser (bsc#1273856, CVE-2026-18401)\n\nChanges for jackson-databind:\n\n- Update to 2.18.11\n * #6185: Bracket unresolved IPv6 host name in InetSocketAddress\n serialization\n * #6203: Prevent unbounded growth of type id cache in\n TypeDeserializer (bsc#1282491, CVE-2026-91776)\n * #6204: Avoid quadratic forward-reference resolution in\n Collection/Map deserializers (bsc#1282492, CVE-2026-91777)\n * #6099: Resolve classes without initialization in\n TypeFactory.findClass()\n * #6116: Reject non-ASCII digits in InetAddress literal validation\n * #6127: Add StreamReadConstraints number len constraint to\n javax.xml.datatype.XMLGregorianCalendar and\n javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)\n * #6129: Limit the supported URL schemes for java.nio.file.Path\n deserialization (bsc#1277883, CVE-2026-19032)\n * #6156: Add java.lang.Comparable in set of unsafe polymorphic\n base types (bsc#1278008, CVE-2026-83557)\n * #6165: Apply number length limits to BigDecimal/BigInteger/\n /Double/Float Map keys\n","status":"published","published":"2026-10-06T14:10:27Z","modified":"2026-10-09T17:23:14.417272976Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24149-1","title":"Security update for jackson-annotations, jackson-core, jackson-databind","description":"This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:\n\n- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues\n  (bsc#1273856).\n- CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without restricting the URI\n  scheme (bsc#1277883).\n- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).\n- CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).\n- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).\n- CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable` deserialization\n  (bsc#1278008).\n- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).\n- CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for\n  unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).\n- CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the raw, attacker-\n  supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).\n- CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan of the pending-\n  reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization\n  (bsc#1282492).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.11\n\nChanges for jackson-core:\n\n- Update to 2.18.11\n * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,\n CVE-2026-89407)\n * #1698: UTF8DataInputJsonParser does not honor\n maxErrorTokenLength when reporting an unrecognized token\n (bsc#1282505, CVE-2026-89425)\n * #1642: Fix maxDocumentLength bypass in async parser\n single-feedInput() case [GHSA-2c4j-63jj-9fqr]\n * #1643: Enforce maxNameLength incrementally in\n ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)\n of async parser (bsc#1273857, CVE-2026-68494)\n non-blocking (async) parser (bsc#1273856, CVE-2026-18401)\n\nChanges for jackson-databind:\n\n- Update to 2.18.11\n * #6185: Bracket unresolved IPv6 host name in InetSocketAddress\n serialization\n * #6203: Prevent unbounded growth of type id cache in\n TypeDeserializer (bsc#1282491, CVE-2026-91776)\n * #6204: Avoid quadratic forward-reference resolution in\n Collection/Map deserializers (bsc#1282492, CVE-2026-91777)\n * #6099: Resolve classes without initialization in\n TypeFactory.findClass()\n * #6116: Reject non-ASCII digits in InetAddress literal validation\n * #6127: Add StreamReadConstraints number len constraint to\n javax.xml.datatype.XMLGregorianCalendar and\n javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)\n * #6129: Limit the supported URL schemes for java.nio.file.Path\n deserialization (bsc#1277883, CVE-2026-19032)\n * #6156: Add java.lang.Comparable in set of unsafe polymorphic\n base types (bsc#1278008, CVE-2026-83557)\n * #6165: Apply number length limits to BigDecimal/BigInteger/\n /Double/Float Map keys\n","status":"published","published":"2026-10-06T14:12:21Z","modified":"2026-10-16T17:23:10.946637755Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4394-1","title":"Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base","description":"This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues:\n\n- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues\n  (bsc#1273856).\n- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).\n- CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).\n- CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).\n- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).\n- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).\n- CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for\n  unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.11\n\nChanges for jackson-bom:\n\n- Update to 2.18.11\n\nChanges for jackson-core:\n  \n- Update to 2.18.11\n * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,\n CVE-2026-89407)\n * #1698: UTF8DataInputJsonParser does not honor\n maxErrorTokenLength when reporting an unrecognized token\n (bsc#1282505, CVE-2026-89425)\n * #1642: Fix maxDocumentLength bypass in async parser\n single-feedInput() case [GHSA-2c4j-63jj-9fqr]\n * #1643: Enforce maxNameLength incrementally in\n ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)\n of async parser (bsc#1273857, CVE-2026-68494)\n non-blocking (async) parser (bsc#1273856, CVE-2026-18401)\n\nChanges for jackson-databind:\n\n- Update to 2.18.11\n * #6185: Bracket unresolved IPv6 host name in InetSocketAddress\n serialization\n * #6203: Prevent unbounded growth of type id cache in\n TypeDeserializer (bsc#1282491, CVE-2026-91776)\n * #6204: Avoid quadratic forward-reference resolution in\n Collection/Map deserializers (bsc#1282492, CVE-2026-91777)\n * #6099: Resolve classes without initialization in\n TypeFactory.findClass()\n * #6116: Reject non-ASCII digits in InetAddress literal validation\n * #6127: Add StreamReadConstraints number len constraint to\n javax.xml.datatype.XMLGregorianCalendar and\n javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)\n * #6129: Limit the supported URL schemes for java.nio.file.Path\n deserialization (bsc#1277883, CVE-2026-19032)\n * #6156: Add java.lang.Comparable in set of unsafe polymorphic\n base types (bsc#1278008, CVE-2026-83557)\n * #6165: Apply number length limits to BigDecimal/BigInteger/\n /Double/Float Map keys\n\nChanges for jackson-dataformat-xml:\n\n- Update to 2.18.11\n * Fix build to avoid past-JDK-8 bytecode generation\n * #891: Enforce StreamReadConstraints.maxNestingDepth in\n FromXmlParser\n\nChanges for jackson-dataformats-binary:\n\n- Update to 2.18.11\n * #783: (protobuf) Support StreamReadConstraints.maxDocumentLength\n in ProtobufParser\n * #785: (avro) Support StreamReadConstraints.maxDocumentLength and\n maxTokenCount in Avro parser\n * #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion\n parser (partial fix for #358)\n * #805: (ion) Support StreamReadConstraints.maxDocumentLength in\n Ion parser (partial fix for #358)\n * #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser\n (bsc#1282639, CVE-2026-68495)\n * #726: (smile) Ensure maxNameLength limit enforced for Smile\n parser (bsc#1282640, CVE-2026-68496)\n * #727: (cbor) CBORParser.nextFieldName(SerializableString)\n confuses 5-bit length marker 23 with 24 ('1-byte length suffix\n follows')\n * #728: (cbor) CBORParser.nextFieldName(SerializableString)\n consumes Object entry slot twice on fast-path miss, truncating\n definite-length Objects\n * #733: (cbor) Long `String`s not added to 'stringref' reference\n table, breaking following references\n * #735: (cbor) 'stringref' property-name paths pass 5-bit length\n marker instead of actual length to shouldReferenceString()\n * #736: (cbor) Long Object property names added to 'stringref'\n reference table twice\n\nChanges for jackson-modules-base:\n\n- Update to 2.18.11\n","status":"published","published":"2026-09-29T11:53:06Z","modified":"2026-09-30T12:00:04.420797068Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}