CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

UBUNTU-CVE-2026-68494

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

CVE-2026-69098

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...

CLSA-2026-1784596282 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 6.10.0-tuxcare.1...

CLSA-2026-1781052738 TuxCare security update for json-schema (1 CVE)

TuxCare rebuilt json-schema to address 1 CVE. Fixed in 0.2.3-tuxcare.1...

CLSA-2026-1779151625 TuxCare security update for ajv (2 CVEs)

TuxCare rebuilt ajv to address 2 CVEs. Fixed in 6.4.0-tuxcare.1...

CLSA-2026-1776818196 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 5.5.2-tuxcare.4...

CLSA-2026-1774916723 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 8.6.2-tuxcare.1...

CLSA-2026-1774398090 TuxCare security update for com.cedarsoftware:json-io (1 CVE)

TuxCare rebuilt com.cedarsoftware:json-io to address 1 CVE. Fixed in 2.9.4-tuxcare.1...

CLSA-2026-1774657370 TuxCare security update for jsonwebtoken (2 CVEs)

TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 0.4.0-tuxcare.1...

CLSA-2026-1773706636 TuxCare security update for json5 (1 CVE)

TuxCare rebuilt json5 to address 1 CVE. Fixed in 0.5.1-tuxcare.1...

CLSA-2026-1773793045 TuxCare security update for is-my-json-valid (2 CVEs)

TuxCare rebuilt is-my-json-valid to address 2 CVEs. Fixed in 2.10.1-tuxcare.1...

CLSA-2026-1773015261 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 8.11.0-tuxcare.1...

CLSA-2026-1773015260 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 8.17.1-tuxcare.3...

CLSA-2026-1773015272 TuxCare security update for is-my-json-valid (2 CVEs)

TuxCare rebuilt is-my-json-valid to address 2 CVEs. Fixed in 2.12.2-tuxcare.1...

CLSA-2025-1761091596 TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20140107-tuxcare.2...

CLSA-2025-1760313982 TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20140107-tuxcare.1...

CLSA-2025-1761177997 TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20090211-tuxcare.3...

CVE-2026-68494

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...