RHLW-2026-BDF75F90D46C1DA0 Lightwell Security Advisory: jackson-core 2.11.3.rhlw-00002

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-core 2.11.3.rhlw-00002 with a backported security fix. CVE-2025-49128: Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation This patched artifact is a drop-in replacement for...

Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation

Overview A flaw in Jackson-core's JsonLocation.appendSourceDesc method allows up to 500 bytes of unintended memory content to be included in exception messages. When parsing JSON from a byte array with an offset and length, the exception message incorrectly reads from the beginning of the array...

CVE-2025-49128

Jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's "JsonLocation.appendSourceDesc" method allows up to 500 bytes of unintended memory content...

CVE-2025-49128: Generation of Error Message Containing Sensitive Information

Jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's JsonLocation.appendSourceDesc method allows up to 500 bytes of unintended memory content t...