Skip to content
Heist/ feed
Back to feed
UnratedFix available

Security update for jackson-annotations, jackson-core, jackson-databind

Type: advisorySources: OSV

This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856). - CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without restricting the URI scheme (bsc#1277883). - CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857). - CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125). - CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641). - CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable` deserialization (bsc#1278008). - CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645). - CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505). - CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the raw, attacker- supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491). - CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan of the pending- reference accumulator for every resolved ID, which can le

Products
jackson-annotations, jackson-core, jackson-databind
Affected versions
Not specified
Fixed versions
2.18.11-160000.1.1
CVEs
CVE-2026-18401, CVE-2026-19032, CVE-2026-68494, CVE-2026-68497, CVE-2026-68498, CVE-2026-83557, CVE-2026-89407, CVE-2026-89425, CVE-2026-91776, CVE-2026-91777
Confirmed fixed CVEs
Not specified
Updated in this feed
30 Oct 2026, 21:43 UTC · Revision 1

Source evidence

Security update for jackson-annotations, jackson-core, jackson-databind

core-osv · Original source

Published 6 Oct 2026, 14:12 UTC

This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856). - CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without restricting the URI scheme (bsc#1277883). - CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857). - CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125). - CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641). - CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable` deserialization (bsc#1278008). - CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645). - CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505). - CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the raw, attacker- supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491). - CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan of the pending- reference accumulator for every resolved ID, which can le

osv:SUSE-SU-2026:24149-1

jackson-annotations

Fixed versions: 2.18.11-160000.1.1

jackson-core

Fixed versions: 2.18.11-160000.1.1

jackson-databind

Fixed versions: 2.18.11-160000.1.1

jackson-annotations

Fixed versions: 2.18.11-160000.1.1

jackson-core

Fixed versions: 2.18.11-160000.1.1

jackson-databind

Fixed versions: 2.18.11-160000.1.1

Complete source record
{
  "id": "8697b1464ada0244165acdcc22f3b58ef28d88c1acd1d439670a673220b10fec",
  "url": "https://osv.dev/vulnerability/SUSE-SU-2026%3A24149-1",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Security update for jackson-annotations, jackson-core, jackson-databind",
    "summary": "This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856). - CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without restricting the URI scheme (bsc#1277883). - CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857). - CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125). - CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641). - CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable` deserialization (bsc#1278008). - CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645). - CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505). - CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the raw, attacker- supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491). - CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan of the pending- reference accumulator for every resolved ID, which can le",
    "evidence": "osv:SUSE-SU-2026:24149-1",
    "products": [
      {
        "name": {
          "value": "jackson-annotations",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.18.11-160000.1.1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "jackson-core",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.18.11-160000.1.1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "jackson-databind",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.18.11-160000.1.1",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "jackson-annotations",
          "evidence": "/affected/3/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.18.11-160000.1.1",
            "evidence": "/affected/3/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "jackson-core",
          "evidence": "/affected/4/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.18.11-160000.1.1",
            "evidence": "/affected/4/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "jackson-databind",
          "evidence": "/affected/5/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.18.11-160000.1.1",
            "evidence": "/affected/5/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "SUSE-SU-2026:24149-1",
      "aliases": [
        "SUSE-SU-2026:24149-1"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.18.11-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "jackson-annotations",
            "purl": "pkg:rpm/suse/jackson-annotations&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24149-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "jackson-core": "2.18.11-160000.1.1",
                "jackson-databind": "2.18.11-160000.1.1",
                "jackson-annotations": "2.18.11-160000.1.1",
                "jackson-core-javadoc": "2.18.11-160000.1.1",
                "jackson-databind-javadoc": "2.18.11-160000.1.1",
                "jackson-annotations-javadoc": "2.18.11-160000.1.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.18.11-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "jackson-core",
            "purl": "pkg:rpm/suse/jackson-core&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24149-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "jackson-core": "2.18.11-160000.1.1",
                "jackson-databind": "2.18.11-160000.1.1",
                "jackson-annotations": "2.18.11-160000.1.1",
                "jackson-core-javadoc": "2.18.11-160000.1.1",
                "jackson-databind-javadoc": "2.18.11-160000.1.1",
                "jackson-annotations-javadoc": "2.18.11-160000.1.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.18.11-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "jackson-databind",
            "purl": "pkg:rpm/suse/jackson-databind&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24149-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "jackson-core": "2.18.11-160000.1.1",
                "jackson-databind": "2.18.11-160000.1.1",
                "jackson-annotations": "2.18.11-160000.1.1",
                "jackson-core-javadoc": "2.18.11-160000.1.1",
                "jackson-databind-javadoc": "2.18.11-160000.1.1",
                "jackson-annotations-javadoc": "2.18.11-160000.1.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.18.11-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "jackson-annotations",
            "purl": "pkg:rpm/suse/jackson-annotations&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24149-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "jackson-core": "2.18.11-160000.1.1",
                "jackson-databind": "2.18.11-160000.1.1",
                "jackson-annotations": "2.18.11-160000.1.1",
                "jackson-core-javadoc": "2.18.11-160000.1.1",
                "jackson-databind-javadoc": "2.18.11-160000.1.1",
                "jackson-annotations-javadoc": "2.18.11-160000.1.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.18.11-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "jackson-core",
            "purl": "pkg:rpm/suse/jackson-core&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24149-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "jackson-core": "2.18.11-160000.1.1",
                "jackson-databind": "2.18.11-160000.1.1",
                "jackson-annotations": "2.18.11-160000.1.1",
                "jackson-core-javadoc": "2.18.11-160000.1.1",
                "jackson-databind-javadoc": "2.18.11-160000.1.1",
                "jackson-annotations-javadoc": "2.18.11-160000.1.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.18.11-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "jackson-databind",
            "purl": "pkg:rpm/suse/jackson-databind&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24149-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "jackson-core": "2.18.11-160000.1.1",
                "jackson-databind": "2.18.11-160000.1.1",
                "jackson-annotations": "2.18.11-160000.1.1",
                "jackson-core-javadoc": "2.18.11-160000.1.1",
                "jackson-databind-javadoc": "2.18.11-160000.1.1",
                "jackson-annotations-javadoc": "2.18.11-160000.1.1"
              }
            ]
          }
        }
      ],
      "modified": "2026-10-16T17:23:10.946637755Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-18401",
        "CVE-2026-19032",
        "CVE-2026-68494",
        "CVE-2026-68497",
        "CVE-2026-68498",
        "CVE-2026-83557",
        "CVE-2026-89407",
        "CVE-2026-89425",
        "CVE-2026-91776",
        "CVE-2026-91777"
      ],
      "references": [
        "https://www.suse.com/support/update/announcement/2026/suse-su-202624149-1/",
        "https://bugzilla.suse.com/1273856",
        "https://bugzilla.suse.com/1273857",
        "https://bugzilla.suse.com/1277883",
        "https://bugzilla.suse.com/1278008",
        "https://bugzilla.suse.com/1280125",
        "https://bugzilla.suse.com/1282491",
        "https://bugzilla.suse.com/1282492",
        "https://bugzilla.suse.com/1282505",
        "https://bugzilla.suse.com/1282641",
        "https://bugzilla.suse.com/1282645",
        "https://www.suse.com/security/cve/CVE-2026-18401",
        "https://www.suse.com/security/cve/CVE-2026-19032",
        "https://www.suse.com/security/cve/CVE-2026-68494",
        "https://www.suse.com/security/cve/CVE-2026-68497",
        "https://www.suse.com/security/cve/CVE-2026-68498",
        "https://www.suse.com/security/cve/CVE-2026-83557",
        "https://www.suse.com/security/cve/CVE-2026-89407",
        "https://www.suse.com/security/cve/CVE-2026-89425",
        "https://www.suse.com/security/cve/CVE-2026-91776",
        "https://www.suse.com/security/cve/CVE-2026-91777"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-18401",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-19032",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-68494",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-68497",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-68498",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-83557",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-89407",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-89425",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-91776",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-91777",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 344606,
  "published_at": "2026-10-06T14:12:21+00:00"
}