Fasterxml Jackson-Core
8 CVEs affecting Fasterxml Jackson-Core. Latest disclosed: 2026-10-16. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-68498 | High | 7.5 | 2026-10-16 | StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being… |
CVE-2026-89425 | High | 7.5 | 2026-09-23 | UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier char… |
CVE-2026-89407 | High | 7.5 | 2026-09-22 | NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[… |
CVE-2026-29062 | High | 7.5 | 2026-03-06 | jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before v… |
CVE-2025-49128 | Medium | 4.0 | 2025-06-06 | Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and… |
CVE-2026-68494 | | 2026-08-04 | The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is inco… | |
CVE-2026-18401 | | 2026-08-04 | The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 cha… | |
CVE-2025-52999 | | 2025-06-25 | jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, i… |