CLSA-2026-1784596282 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 6.10.0-tuxcare.1...

CLSA-2026-1781052738 TuxCare security update for json-schema (1 CVE)

TuxCare rebuilt json-schema to address 1 CVE. Fixed in 0.2.3-tuxcare.1...

CLSA-2026-1779151625 TuxCare security update for ajv (2 CVEs)

TuxCare rebuilt ajv to address 2 CVEs. Fixed in 6.4.0-tuxcare.1...

CLSA-2026-1776818196 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 5.5.2-tuxcare.4...

CLSA-2026-1774916723 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 8.6.2-tuxcare.1...

CLSA-2026-1774657370 TuxCare security update for jsonwebtoken (2 CVEs)

TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 0.4.0-tuxcare.1...

CLSA-2026-1774398090 TuxCare security update for com.cedarsoftware:json-io (1 CVE)

TuxCare rebuilt com.cedarsoftware:json-io to address 1 CVE. Fixed in 2.9.4-tuxcare.1...

CLSA-2026-1773793045 TuxCare security update for is-my-json-valid (2 CVEs)

TuxCare rebuilt is-my-json-valid to address 2 CVEs. Fixed in 2.10.1-tuxcare.1...

CLSA-2026-1773706636 TuxCare security update for json5 (1 CVE)

TuxCare rebuilt json5 to address 1 CVE. Fixed in 0.5.1-tuxcare.1...

CLSA-2026-1773015261 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 8.11.0-tuxcare.1...

CLSA-2026-1773015272 TuxCare security update for is-my-json-valid (2 CVEs)

TuxCare rebuilt is-my-json-valid to address 2 CVEs. Fixed in 2.12.2-tuxcare.1...

CLSA-2026-1773015260 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 8.17.1-tuxcare.3...

CLSA-2025-1761091596 TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20140107-tuxcare.2...

CLSA-2025-1761177997 TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20090211-tuxcare.3...

CLSA-2025-1760313982 TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20140107-tuxcare.1...

CVE-2026-68494

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

Summarydatamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schema. When a property carries a "defaultfactory" key, its value is interpolated verbatim — as a raw Python expressio...

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

Summarydatamodel-code-generator resolves JSON-Schema $ref targets that point at the local filesystem without restricting them to the input/base directory and without honoring the remote-reference security control. In the default configuration, an attacker who controls an input schema a "paste you...

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

SummaryJSON-Schema $ref values pointing at HTTP or HTTPS URLs are silently dereferenced by datamodel-code-generator with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The --allow-remote-refs gate added in 0.56.0 defaults to None, which only emits a deprecati...