fasterxml/jackson-core Security Advisories | GitStock

high2026-10-01

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

GHSA-7hhh-6rmp-j9qf · CVE-2026-89425

high2026-10-01

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

GHSA-p6pp-m3f8-5c89 · CVE-2026-89407

high2026-07-21

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

GHSA-r7wm-3cxj-wff9 · CVE-2026-68494

high2026-04-04

Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers

GHSA-2m67-wjpj-xhg9

high2026-03-04

jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion

GHSA-6v53-7c9g-w56r · CVE-2026-29062

medium2026-02-28

jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition

GHSA-72hv-8253-57qq · CVE-2026-18401

high2025-06-27

jackson-core can throw a StackoverflowError when processing deeply nested data

GHSA-h46c-h94j-95f3 · CVE-2025-52999

medium2025-06-07

Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation

GHSA-wf8f-6423-gfxg · CVE-2025-49128