ROOT-APP-MAVEN-CVE-2026-18401 CVE-2026-18401 in tools.jackson.core:jackson-core - Patched by Root

Root has patched CVE-2026-18401 in the tools.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda, geoserver, spark-fips, nuxeo, pinot, wavefront-proxy, nacos, camunda-zeebe, akhq, sonarqube, pinot-fips, ruby3.3-jrjackson, confluent-kafka-jre-bcfips, ruby3.2-jrjackson, apache-tika, tritonserver-backend-vllm-cuda-12.9, flyway-fips,...

CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: nextflow, akhq, kafka, zipkin, sonarqube, solr, spark, jenkins, scala, airflow, strimzi-kafka-operator, infinispan, confluent-kafka, apache-tika, flyway, kserve-modelmesh, ruby4.0-jrjackson, druid, ruby3.3-jrjackson, celeborn, trino, gradle-stage0, dependency-track,...

CVE-2026-18401

creationtimestamp| type| source ---|---|--- 2026-09-01 20:35:07+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-72hv-8253-57qq...

EUVD-2026-52703

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...