CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: apache-tika-fips, cassandra-fips, jenkins-plugin-manager, zookeeper-fips, management-api-for-apache-cassandra-5.0, nuxeo, tez, s3proxy, kayenta, localstack, solr, ruby3.4-jrjackson, celeborn, dependency-track-apiserver, geoserver, apache-activemq-fips, gradle-stage0,...

CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: ruby3.2-jrjackson, tez, flyway, kafka, apicurio-registry, gradle-stage0, druid, solr, spark, dependency-track, thingsboard, apache-tika, infinispan, trino, spdx-tools-java, cass-config-builder, nextflow, apache-nifi, airflow, scala, akhq, ruby3.3-jrjackson,...

EUVD-2026-52703

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...