{"action":"Upgrade tools.jackson.core:jackson-core to 3.1.4 or later.","affected":[{"fixed":"3.1.4","introduced":"3.0.0"}],"component":"tools.jackson.core:jackson-core","cve_ids":["CVE-2026-68494"],"ecosystem":"Maven","epss":0.00463,"exploited":false,"fixed_versions":["3.1.4"],"ghsa_id":"GHSA-r7wm-3cxj-wff9","id":"tcs_01M5N9B81MCXEZ2AH869ZHPNB7","modified_at":"2026-10-02T23:15:06.853935725Z","published_at":"2026-07-21T21:58:53Z","references":["https://osv.dev/vulnerability/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://nvd.nist.gov/vuln/detail/CVE-2026-68494","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-r7wm-3cxj-wff9#Maven/tools.jackson.core:jackson-core","url":"https://osv.dev/vulnerability/GHSA-r7wm-3cxj-wff9"},{"source":"nvd","source_id":"CVE-2026-68494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494"}],"summary":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"}