ROOT-APP-MAVEN-CVE-2026-18401 CVE-2026-18401 in tools.jackson.core:jackson-core - Patched by Root

Root has patched CVE-2026-18401 in the tools.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: apache-pulsar-fips, flyway-fips, opensearch, ruby3.4-jrjackson, tez, kafka-bridge-fips, hadoop-fips, gradle, ruby3.2-jrjackson, conductor-fips, solr, airflow, geoserver, camunda, jenkins-plugin-manager, kafbat-ui-fips, nacos, apache-nifi-registry, zookeeper-fips,...

CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: ruby3.2-jrjackson, confluent-kafka, apache-nifi-registry, ruby4.0-jrjackson, spdx-tools-java, wavefront-proxy, akhq, kserve-modelmesh, scala, strimzi-kafka-operator, zookeeper, apache-pulsar, management-api-for-apache-cassandra-5.0, apicurio-registry, logstash,...

CVE-2026-18401

creationtimestamp| type| source ---|---|--- 2026-09-01 20:35:07+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-72hv-8253-57qq...

EUVD-2026-52703

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +5134 more potentially affected by CVE-2026-18401 via tools.jackson.core:jackson-core (>=3.0.0, <=3.1.0-rc1)

tools.jackson.core:jackson-core MAVEN version =3.0.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.0, =0.0.1, =0.8.0, =0.6.0, =0.9.1 and more Source cves:...

ac.pao:reports-web (1.0.0), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +27881 more potentially affected by CVE-2026-18401 via com.fasterxml.jackson.core:jackson-core (>=2.19.0, <=2.21.0)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.19.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =0.0.4, =0.0.6 and more Source cves:...