CLEANSTART-2026-PC54131 UTF8DataInputJsonParser

CVE-2026-89425 affects multiple packages. UTF8DataInputJsonParser. See references for individual vulnerability details...

CLEANSTART-2026-BS92319 UTF8DataInputJsonParser

Security vulnerability affects the spark package. UTF8DataInputJsonParser...

CLEANSTART-2026-EJ84635 UTF8DataInputJsonParser

Security vulnerability affects the trino package. UTF8DataInputJsonParser...

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Status FULLY REPRODUCED. A malformed token fed through createParserDataInput produced a 20,000,109-character exception message from a 20-million-character attacker payload, while the identical payload fed through createParserInputStream produced a correctly bounded 367-character message. Affected...

GHSA-7HHH-6RMP-J9QF jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Status FULLY REPRODUCED. A malformed token fed through createParserDataInput produced a 20,000,109-character exception message from a 20-million-character attacker payload, while the identical payload fed through createParserInputStream produced a correctly bounded 367-character message. Affected...

EUVD-2026-85000

jackson-core: UTF8DataInputJsonParser.reportInvalidToken missing maxErrorTokenLength limit - unbounded StringBuilder growth DoS...

Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues: CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues...

CLEANSTART-2026-MR78444 UTF8DataInputJsonParser

Security vulnerability affects the apache-nifi package. UTF8DataInputJsonParser...

PT-2026-105238

Security vulnerability affects the apache-nifi package. UTF8DataInputJsonParser...

PT-2026-99155

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues...

SUSE CVE-2026-89425

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

CVE-2026-89425

A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted, malformed token to the JsonFactory.createParserDataInput method. The UTF8DataInputJsonParser component, responsible for handling DataInput...

CVE-2026-89425

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

DEBIAN-CVE-2026-89425

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

CVE-2026-89425

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

UBUNTU-CVE-2026-89425

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the reportInvalidTokenint, String, String method of UTF8DataInputJsonParser, which accumulates invalid token characters into a StringBuilder with no check against...

Allocation of Resources Without Limits or Throttling

Overview com.fasterxml.jackson.core:jackson-core is a Core Jackson abstractions, basic JSON streaming API implementation Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the reportInvalidTokenint, String, String method of...

CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...