| CVE-2026-68498 |
StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON…
|
7.5
High
|
Oct 16, 2026 |
| CVE-2026-89425 |
UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error…
|
7.5
High
|
Sep 23, 2026 |
| CVE-2026-89407 |
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular…
|
7.5
High
|
Sep 22, 2026 |
| CVE-2026-68494 |
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint…
|
8.7
High
|
Aug 4, 2026 |
| CVE-2026-18401 |
The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in…
|
6.9
Medium
|
Aug 4, 2026 |
| CVE-2026-29062 |
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data…
|
8.7
High
|
Mar 6, 2026 |
| CVE-2025-52999 |
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data…
|
8.7
High
|
Jun 25, 2025 |
| CVE-2025-49128 |
Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data…
|
4.0
Medium
|
Jun 6, 2025 |