CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: wildfly, apache-nifi-registry, logstash, nuxeo, jenkins, gradle-stage0, cass-config-builder-fips, dependency-track, kafka-bridge-fips, dependency-track-apiserver, elasticsearch, ruby3.3-jrjackson, logstash-fips, pinot-fips, solr, conductor, ontop, cassandra-reaper,...

CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, spdx-tools-java, airflow, kafka, wildfly, zookeeper, gradle-stage0, thingsboard, ruby4.0-jrjackson, neo4j, jenkins-plugin-manager, ruby3.2-jrjackson, apache-nifi, cass-config-builder, flyway, solr, wavefront-proxy, druid, ruby3.3-jrjackson, logstash...

EUVD-2026-52703

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...