io.root.tools.jackson.core:jackson-core vulnerabilities (Root)
6 vulnerabilities.
-
io.root.tools.jackson.core:jackson-coreRoot jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth 7.5 High -
io.root.tools.jackson.core:jackson-coreRoot jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS 7.5 High -
io.root.tools.jackson.core:jackson-coreRoot jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) 8.7 High -
io.root.tools.jackson.core:jackson-coreRoot Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers 7.5 High -
io.root.tools.jackson.core:jackson-coreRoot jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion 8.7 High -
io.root.tools.jackson.core:jackson-coreRoot jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service 6.9 Medium