What’s Vulnerable › Products

FasterXML jackson-core vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your FasterXML jackson-core version is affected

Latest FasterXML jackson-core vulnerabilities

• CVE-2026-68498 — jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service (CVSS 7.5)
• CVE-2026-89425 — jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth (CVSS 7.5)
• CVE-2026-89407 — jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS (CVSS 7.5)
• CVE-2026-68494 — jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) (CVSS 8.7)
• CVE-2026-18401 — jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service (CVSS 6.9)
• CVE-2026-29062 — jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion (CVSS 7.5)
• CVE-2025-52999 — jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data (CVSS 8.7)
• CVE-2025-49128 — Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation (CVSS 4.0)