CVE-2026-68494
2 advisories.
Maven/com.fasterxml.jackson.core:jackson-core CVE-2026-68494: high
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
Action: Upgrade com.fasterxml.jackson.core:jackson-core to 2.18.8 (2.18.x) or 2.21.4 (2.21.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.18.8 | - |
| 2.19.0 | 2.21.4 | - |
Fixed versions
| 2.18.8 | 2.21.4 |
Sources
- osv: GHSA-r7wm-3cxj-wff9
- https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9
- https://nvd.nist.gov/vuln/detail/CVE-2026-68494
- https://github.com/FasterXML/jackson-core/pull/1611
- https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd
- https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641
- https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8
- https://github.com/FasterXML/jackson-core
CVE-2026-68494 · published · modified · JSON
Maven/tools.jackson.core:jackson-core CVE-2026-68494: high
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
Action: Upgrade tools.jackson.core:jackson-core to 3.1.4 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.1.4 | - |
Fixed versions
| 3.1.4 |
Sources
- osv: GHSA-r7wm-3cxj-wff9#Maven/tools.jackson.core:jackson-core
- https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9
- https://nvd.nist.gov/vuln/detail/CVE-2026-68494
- https://github.com/FasterXML/jackson-core/pull/1611
- https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd
- https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641
- https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8
- https://github.com/FasterXML/jackson-core
CVE-2026-68494 · published · modified · JSON