Injection com.fasterxml.jackson.core:jackson-databind Dependency in Crucible Server

This High severity Injection vulnerability was introduced in versions 4.9.0 of Crucible. This Injection vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H allows an unauthenticated attacker to modify the actions taken by a system call which h...

Security Bulletin: IBM Db2 Bridge is vulnerable due to Jackson-databind ( CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518)

Summary Jackson databind is used as part of IBM Db2 Bridge and it was affected by vulnerabilities described in the vulnerability details. This issue Affected users using Db2 Bridge 1.1.5 and new Fix pack was release to address the issue. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION:...

GHSA-6QM2-MCQ7-53QP Duplicate Advisory: jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72hv-8253-57qq. This link is maintained to preserve external references. Original Description The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in...

CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

CLSA-2026-1777941827 TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.14.2-tuxcare.1...

CVE-2026-68494

This CVE notes an incomplete fix for CVE-2026-18401 in jackson-core’s non-blocking parser, leaving a remaining bypass for number-length constraints when data is streamed in many small chunks. The issue arises in the async parser path (MINOR_NUMBER_INTEGER_DIGITS) where validateIntegerLength() is ...

CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

CVE-2026-68494

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

EUVD-2026-52699

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

CVE-2026-18401 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

CVE-2026-18401 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

CVE-2026-18401

The CVE describes a vulnerability in jackson-core’s non-blocking (async) JSON parser where maxNumberLength is not enforced, unlike the synchronous parser. Root cause: the async parsing path in NonBlockingUtf8JsonParserBase does not invoke number length validation; _finishNumberIntegralPart() accu...

ROOT-APP-MAVEN-CVE-2026-54517 CVE-2026-54517 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54517 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-54518 CVE-2026-54518 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54518 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-54516 CVE-2026-54516 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54516 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-GHSA-2M67-WJPJ-XHG9 GHSA-2m67-wjpj-xhg9 in tools.jackson.core:jackson-core - Patched by Root

Root has patched GHSA-2m67-wjpj-xhg9 in the tools.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-29062 CVE-2026-29062 in tools.jackson.core:jackson-core - Patched by Root

Root has patched CVE-2026-29062 in the tools.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

Security Bulletin: Vulnerabilities in jackson-databind may affect IBM APM Linux KVM Agent for Virtual Environments.

Summary There are vulnerabilities in the jackson-databind jar used by IBM APM Linux KVM Agent for Virtual Environments. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From...

Linux Distros Unpatched Vulnerability : CVE-2026-18401

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000...