Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

jackson-core — Vulnerabilities & Security Advisories 8

All 8 CVE vulnerabilities found in jackson-core, with AI-generated Chinese analysis, references, and POCs.

Vendor: FasterXML

CVE ID Title CVSS Severity Published
CVE-2026-68498 jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service CWE-400 7.5 High 2026-10-16
CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth CWE-770 7.5 High 2026-09-23
CVE-2026-89407 jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS CWE-1333 7.5 High 2026-09-22
CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) CWE-770 8.7 High 2026-08-04
CVE-2026-18401 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service CWE-770 6.9 Medium 2026-08-04
CVE-2026-29062 jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion CWE-770 7.5 - 2026-03-06
CVE-2025-52999 jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data CWE-121 6.5 - 2025-06-25
CVE-2025-49128 Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation CWE-209 4.0 Medium 2025-06-06

All 8 known CVE vulnerabilities affecting jackson-core with full Chinese analysis, references, and POCs where available.