jackson-core vulnerabilities
3 known CVE vulnerabilities in jackson-core, translated and rated.
- CVE-2026-68494High
The fix for CVE-2026-18401 in jackson-core is incomplete and leaves a bypass in the non-blocking parser. An attacker can stream JSON in small chunks without a terminator, causing unbounded buffer growth limited only by maxStringLength (20 MiB) instead of maxNumberLength (1000).
- CVE-2026-18401Medium
The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint (default: 1000 characters) defined in StreamReadConstraints. An attacker can submit a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service (DoS). The issue affects jackson-core versions 2.15.0–2.18.5 and 2.19.0–2.21.0, as well as tools.jackson.core 3.0.0–3.0.x.
- CVE-2026-29062High
In jackson-core versions 3.0.0 through 3.1.0, the UTF8DataInputJsonParser and ReaderBasedJsonParser bypass the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. This allows an attacker to supply a deeply nested JSON document, causing a StackOverflowError and Denial of Service (DoS). The issue is fixed in version 3.1.0.