SUSE-SU-2026:24149-1 Security update for jackson-annotations, jackson-core, jackson-databind

This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues bsc1273856. - CVE-2026-19032: deserializer for java.nio.file.Path resolves attacker-suppli...

PT-2026-99157

Name of the Vulnerable Software and Affected Versions jackson-core versions 2.16.0 through 2.18.0 jackson-core versions 3.0.0 through 3.0.0 Description Parsers built over character input, such as Reader, String, or char sources served by ReaderBasedJsonParser, fail to properly apply the...

Duplicate Advisory: jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r7wm-3cxj-wff9. This link is maintained to preserve external references. Original Description The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint...