FasterXML jackson-core
8 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-68498 | 2.16.0 – < 2.18.10 ; 2.19.0 – < 2.21.6 ; 2.22.0 – < 2.22.2 | jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service | HIGH 7.5 | 0.7 % | ||
| CVE-2026-89425 | 2.8.0 – 2.18.10 ; 2.19.0 – 2.21.6 ; 2.22.0 – 2.22.2 | jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth | HIGH 7.5 | 0.5 % | ||
| CVE-2026-89407 | 2.17.0 – 2.18.10 ; 2.19.0 – 2.21.6 ; 2.22.0 – 2.22.2 | jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS | HIGH 7.5 | 0.6 % | ||
| CVE-2026-68494 | 2.15.0 – < 2.18.8 ; 2.19.0 – < 2.21.4 | jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) | HIGH 8.7 | 0.5 % | ||
| CVE-2026-18401 | 2.15.0 – 2.18.5 ; 2.19.0 – < 2.21.1 | jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-29062 | >= 3.0.0, < 3.1.0 | jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion | HIGH 8.7 | 0.6 % | ||
| CVE-2025-52999 | < 2.15.0 | jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data | HIGH 8.7 | 0.8 % | ||
| CVE-2025-49128 | >= 2.0.0, < 2.13.0 | Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation | MEDIUM 4.0 | 0.4 % |