jackson

Analysis and Remediation of Security Vulnerabilities in Jackson core 2.13.5 CVE-2025-52999 SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 GHSA-2m67-wjpj-xhg9 SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538 Sonatype-2022-6438 This branch...

CLEANSTART-2026-HI70991 StreamReadConstraints

CVE-2026-68498 affects multiple packages. StreamReadConstraints. See references for individual vulnerability details...

CLEANSTART-2026-DJ12675 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the sonarqube package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CLEANSTART-2026-CZ74700 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the sonarqube package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CLEANSTART-2026-YO61025 StreamReadConstraints

Security vulnerability affects the spark-sc213-jdk17-py312 package. StreamReadConstraints...

CLEANSTART-2026-KI58922 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the elasticsearch package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CLEANSTART-2026-KF07294 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the elasticsearch package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

FreeBSD: VID-0cb42b4a-9f19-11f1-a655-3497f65b111b (CVE-2026-68498): jackson-core -- StreamReadConstraints can be bypassed

StreamReadConstraints.maxNameLength default 50,000 characters is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength default 100,000,000 characters that bounds ordinary string values. For parsers bui...

CLEANSTART-2026-XU96478 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

CVE-2026-68496 affects multiple packages. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...

CLEANSTART-2026-OQ29524 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

CVE-2026-68495 affects multiple packages. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...

CLEANSTART-2026-CH00220 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the solr package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CLEANSTART-2026-AR08566 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the solr package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

PT-2026-122269

Security vulnerability affects the solr package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

PT-2026-122261

Security vulnerability affects the solr package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CVE-2026-68496: Allocation of Resources Without Limits or Throttling

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68495: Allocation of Resources Without Limits or Throttling

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495: Allocation of Resources Without Limits or Throttling

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

FreeBSD : jackson-core -- StreamReadConstraints can be bypassed (0cb42b4a-9f19-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0cb42b4a-9f19-11f1-a655-3497f65b111b advisory. The Jackson project reports: Enforce maxNameLength incrementally in ReaderBasedJsonParser Fail parsing...

Amazon Linux 2023 : jackson-core (ALAS2023-2026-2067)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2067 advisory. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit...

Important: jackson-core

Issue Overview: The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of...