jackson-core — security advisory
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller. As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes. The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositi
- Products
- jackson-core
- Affected versions
- 2.10.0-1, 2.10.1-1, 2.12.1-1, 2.13.0-1, 2.13.0-2, 2.14.1-1, 2.14.1-1build1, 2.14.1-2, 2.4.2-2, 2.8.6-1, 2.9.1-1, 2.9.4-1, 2.9.8-3, 2.9.8-3~18.04
- Fixed versions
- Not specified
- CVEs
- CVE-2026-68494
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:50 UTC · Revision 1
Source evidence
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller. As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes. The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositi
osv:UBUNTU-CVE-2026-68494
jackson-core
Fixed versions: Not specified
jackson-core
Fixed versions: Not specified
jackson-core
Fixed versions: Not specified
jackson-core
Fixed versions: Not specified
jackson-core
Fixed versions: Not specified
jackson-core
Fixed versions: Not specified
jackson-core
Fixed versions: Not specified
Complete source record
{
"id": "92b18c4361b20f7500b397bdc67e26ee93c3e53eb9acf3b20e00ea1240999e88",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-68494",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-68494",
"summary": "The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller. As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes. The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositi",
"evidence": "osv:UBUNTU-CVE-2026-68494",
"products": [
{
"name": {
"value": "jackson-core",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.4.2-2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "jackson-core",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.8.6-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.9.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.9.4-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.9.8-3~18.04",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "jackson-core",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.9.8-3",
"evidence": "/affected/2/versions"
},
{
"value": "2.10.0-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.10.1-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "jackson-core",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.12.1-1",
"evidence": "/affected/3/versions"
},
{
"value": "2.13.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "2.13.0-2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "jackson-core",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.14.1-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "jackson-core",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.14.1-1build1",
"evidence": "/affected/5/versions"
},
{
"value": "2.14.1-2",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "jackson-core",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.14.1-1",
"evidence": "/affected/6/versions"
},
{
"value": "2.14.1-1build1",
"evidence": "/affected/6/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-68494",
"aliases": [
"UBUNTU-CVE-2026-68494"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-core",
"purl": "pkg:deb/ubuntu/jackson-core?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.4.2-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68494.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-core-java",
"binary_version": "2.4.2-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-core",
"purl": "pkg:deb/ubuntu/jackson-core?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"2.8.6-1",
"2.9.1-1",
"2.9.4-1",
"2.9.8-3~18.04"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68494.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-core-java",
"binary_version": "2.9.8-3~18.04"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-core",
"purl": "pkg:deb/ubuntu/jackson-core?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"2.9.8-3",
"2.10.0-1",
"2.10.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68494.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-core-java",
"binary_version": "2.10.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-core",
"purl": "pkg:deb/ubuntu/jackson-core?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"2.12.1-1",
"2.13.0-1",
"2.13.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68494.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-core-java",
"binary_version": "2.13.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-core",
"purl": "pkg:deb/ubuntu/jackson-core?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"2.14.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68494.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-core-java",
"binary_version": "2.14.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-core",
"purl": "pkg:deb/ubuntu/jackson-core?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"2.14.1-1build1",
"2.14.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68494.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-core-java",
"binary_version": "2.14.1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-core",
"purl": "pkg:deb/ubuntu/jackson-core?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"2.14.1-1",
"2.14.1-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68494.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-core-java",
"binary_version": "2.14.1-1build1"
}
]
}
}
],
"modified": "2026-10-17T12:59:20.775716875Z",
"provider": "osv",
"upstream": [
"CVE-2026-68494"
],
"references": [
"https://ubuntu.com/security/CVE-2026-68494",
"https://www.cve.org/CVERecord?id=CVE-2026-68494",
"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"https://github.com/FasterXML/jackson-core/pull/1611",
"https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"https://github.com/advisories/GHSA-72hv-8253-57qq",
"https://www.cve.org/CVERecord?id=CVE-2026-18401"
]
},
"related_cves": [
{
"value": "CVE-2026-68494",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 359624,
"published_at": "2026-08-04T15:16:00+00:00"
}