tocsin

CVE-2026-89425

2 advisories.

Maven/com.fasterxml.jackson.core:jackson-core CVE-2026-89425: high 7.5

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Action: Upgrade com.fasterxml.jackson.core:jackson-core to 2.18.11 (2.18.x), 2.21.7 (2.21.x) or 2.22.3 (2.22.x) or later.

Affected

introducedfixedlast affected
2.19.02.21.7-
2.22.02.22.3-
2.8.02.18.11-

Fixed versions

2.21.72.22.32.18.11

Sources

CVE-2026-89425 · published · modified · JSON

Maven/tools.jackson.core:jackson-core CVE-2026-89425: high 7.5

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Action: Upgrade tools.jackson.core:jackson-core to 3.1.7 (3.1.x) or 3.2.3 (3.2.x) or later.

Affected

introducedfixedlast affected
3.0.03.1.7-
3.2.03.2.3-

Fixed versions

3.1.73.2.3

Sources

CVE-2026-89425 · published · modified · JSON