ROOT-APP-MAVEN-CVE-2026-18401 CVE-2026-18401 in tools.jackson.core:jackson-core - Patched by Root

Root has patched CVE-2026-18401 in the tools.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: flyway, apache-hop, camunda, spark-kubernetes-operator, nextflow, kafka, ruby3.3-jrjackson, reposilite, spdx-tools-java, kafka-bridge, ruby3.2-jrjackson, spark, management-api-for-apache-cassandra-4.0, gradle-stage0, nacos-docker, conductor, hadoop-fips,...

CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: neo4j, trino, apache-nifi, confluent-kafka, zookeeper, apicurio-registry, scala, opensearch, gradle-stage0, management-api-for-apache-cassandra-5.0, wildfly, jenkins, spdx-tools-java, flyway, ruby3.3-jrjackson, ruby3.4-jrjackson, celeborn, apache-tika, airflow,...

CVE-2026-18401

creationtimestamp| type| source ---|---|--- 2026-09-01 20:35:07+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-72hv-8253-57qq...

EUVD-2026-52703

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...