Skip to content
Fasterxml Jackson-core vulnerabilities
-
fasterxml jackson-core
jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service
CVE-2026-68498
Fix available
7.5 High
-
fasterxml jackson-core
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth
CVE-2026-89425
Fix available
7.5 High
-
fasterxml jackson-core
jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
CVE-2026-89407
Fix available
7.5 High
-
fasterxml jackson-core
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
CVE-2026-68494
Fix available
8.7 High
-
fasterxml jackson-core, red hat certificate system 10, enterprise linux 10 +2 more +4 more
jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
CVE-2026-29062
Fix available
8.7 High
-
fasterxml jackson-core
jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service
CVE-2026-18401
Fix available
6.9 Medium
-
fasterxml jackson-core
jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data
CVE-2025-52999
Public exploitFix available
8.7 High
-
fasterxml jackson-core
Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation
CVE-2025-49128
Fix available
4.0 Medium