ROOT-APP-MAVEN-CVE-2026-18401 CVE-2026-18401 in tools.jackson.core:jackson-core - Patched by Root

Root has patched CVE-2026-18401 in the tools.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, pinot, ruby4.0-jrjackson, celeborn, apache-pulsar, knative-kafka-broker-fips, elasticsearch-fips, logstash, nacos, apache-hop-fips, ruby3.4-jrjackson, kserve-modelmesh, management-api-for-apache-cassandra-5.0, nuxeo, s3proxy, kafka, spark-fips...

CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: infinispan, apache-tika, ruby4.0-jrjackson, thingsboard, wavefront-proxy, strimzi-kafka-operator, dependency-track, cass-config-builder, neo4j, airflow, opensearch, zookeeper, apache-nifi, celeborn, wildfly, apicurio-registry, jenkins, logstash, nextflow, druid, solr...

CVE-2026-18401

creationtimestamp| type| source ---|---|--- 2026-09-01 20:35:07+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-72hv-8253-57qq...

EUVD-2026-52703

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +5159 more potentially affected by CVE-2026-18401 via tools.jackson.core:jackson-core (>=3.0.0, <=3.1.0-rc1)

tools.jackson.core:jackson-core MAVEN version =3.0.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.0, =0.0.1, =0.8.0, =0.6.0, =0.9.1 and more Source cves:...

ac.pao:reports-web (1.0.0), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +27929 more potentially affected by CVE-2026-18401 via com.fasterxml.jackson.core:jackson-core (>=2.19.0, <=2.21.0)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.19.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =0.0.4, =0.0.6 and more Source cves:...