{"action":"Upgrade com.fasterxml.jackson.core:jackson-core to 2.18.8 (2.18.x) or 2.21.4 (2.21.x) or later.","affected":[{"fixed":"2.18.8","introduced":"0"},{"fixed":"2.21.4","introduced":"2.19.0"}],"component":"com.fasterxml.jackson.core:jackson-core","cve_ids":["CVE-2026-68494"],"ecosystem":"Maven","epss":0.00463,"exploited":false,"fixed_versions":["2.18.8","2.21.4"],"ghsa_id":"GHSA-r7wm-3cxj-wff9","id":"tcs_01M5N9B7XC2GX5RNK2FTGGBQEX","modified_at":"2026-10-02T23:15:06.853935725Z","published_at":"2026-07-21T21:58:53Z","references":["https://osv.dev/vulnerability/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://nvd.nist.gov/vuln/detail/CVE-2026-68494","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-r7wm-3cxj-wff9","url":"https://osv.dev/vulnerability/GHSA-r7wm-3cxj-wff9"},{"source":"nvd","source_id":"CVE-2026-68494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494"}],"summary":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"}