ROOT-APP-MAVEN-GHSA-R7WM-3CXJ-WFF9 GHSA-r7wm-3cxj-wff9 in com.fasterxml.jackson.core:jackson-core - Patched by Root

Root has patched GHSA-r7wm-3cxj-wff9 in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-GHSA-72HV-8253-57QQ GHSA-72hv-8253-57qq in com.fasterxml.jackson.core:jackson-core - Patched by Root

Root has patched GHSA-72hv-8253-57qq in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-AIKIDO-2026-665392 AIKIDO-2026-665392 in com.fasterxml.jackson.core:jackson-core - Patched by Root

Root has patched AIKIDO-2026-665392 in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

CLEANSTART-2026-GA95827 Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor

Security vulnerability affects the apache-hive package. Jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor...

Security Bulletin:Inconsistent Enforcement of MaxNumberLength in Jackson-Core Async JSON Parser, Leading to DoS

Summary The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

CLEANSTART-2026-DS38629 jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor

Security vulnerability affects the sonarqube package. jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor...

CLEANSTART-2026-FD40389 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

Security vulnerability affects the sonarqube package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

Security Bulletin: Vulnerability reported in jackson-core-2.18.6.jar for APIM 11.1 is now addressed

Summary Vulnerability reported in jackson-core-2.18.6.jar for APIM 11.1 is now addressed Vulnerability Details CVEID:CVE-2026-68494 DESCRIPTION: The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is...

jackson

Analysis and Remediation of Security Vulnerabilities in Jackson core 2.13.5 CVE-2025-52999 SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 GHSA-2m67-wjpj-xhg9 SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538 Sonatype-2022-6438 This branch...

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Status FULLY REPRODUCED. A malformed token fed through createParserDataInput produced a 20,000,109-character exception message from a 20-million-character attacker payload, while the identical payload fed through createParserInputStream produced a correctly bounded 367-character message. Affected...

EUVD-2026-85000

jackson-core: UTF8DataInputJsonParser.reportInvalidToken missing maxErrorTokenLength limit - unbounded StringBuilder growth DoS...

GHSA-7HHH-6RMP-J9QF jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Status FULLY REPRODUCED. A malformed token fed through createParserDataInput produced a 20,000,109-character exception message from a 20-million-character attacker payload, while the identical payload fed through createParserInputStream produced a correctly bounded 367-character message. Affected...

EUVD-2026-84498

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERNFLOAT via looksLikeValidNumber...

GHSA-P6PP-M3F8-5C89 jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

Status FULLY REPRODUCED with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for every doubling of input size across five consecutive doublings 5,000 → 160,000 characters, confirming On² behavior. A single 160,000-character string smaller than a typical HTTP request...

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

Status FULLY REPRODUCED with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for every doubling of input size across five consecutive doublings 5,000 → 160,000 characters, confirming On² behavior. A single 160,000-character string smaller than a typical HTTP request...

CLEANSTART-2026-BR90501 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...