MavenPackage

com.fasterxml.jackson.core:jackson-core

6 known vulnerabilities (4 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 2.23.0 (Nov 8, 2026): no advisory affects it
Newest unaffected release: 2.23.0 (Nov 8, 2026), the latest release
Advisories: 6 · 4 high, 2 medium

Dependents: 4,998
Releases: 198 since 2.0.0 (Mar 25, 2012)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-89425
Affects 2.8.0 to 2.18.10 (2.18.11 is outside it); 2.19.0 to 2.21.6 (2.21.7 is outside it); 2.22.0 to 2.22.2 (2.22.3 is outside it)
CVE-2026-89407
Affects 2.17.0 to 2.18.10 (2.18.11 is outside it); 2.19.0 to 2.21.6 (2.21.7 is outside it); 2.22.0 to 2.22.2 (2.22.3 is outside it)
CVE-2026-68494
Affects 2.0.0-RC1 to 2.18.7 (2.18.8 is outside it); 2.19.0 to 2.21.3 (2.21.4 is outside it)
CVE-2026-18401
Affects 2.15.0 to 2.18.5 (2.18.6 is outside it); 2.19.0 to 2.21.0 (2.21.1 is outside it)
CVE-2025-52999
Affects 2.0.0-RC1 to 2.15.0-rc3 (2.15.0 is outside it)
CVE-2025-49128
Affects 2.0.0 to 2.13.0-rc2 (2.13.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

CVE-2026-89425High 7.5
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth
Affected: from 2.8.0, through 2.18.10; from 2.19.0, through 2.21.6; from 2.22.0, through 2.22.2; from 2.19.0, fixed in 2.21.7; from 2.22.0, fixed in 2.22.3; from 2.8.0, fixed in 2.18.11.
Fixed in 2.18.11 (released Sep 20, 2026, 3 days before disclosure), 2.21.7 (released Sep 21, 2026, 2 days before disclosure) and 2.22.3 (released Sep 21, 2026, 2 days before disclosure).
The latest release, 2.23.0, is not affected.
CVE-2026-89407High 7.5
jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
Affected: from 2.17.0, through 2.18.10; from 2.19.0, through 2.21.6; from 2.22.0, through 2.22.2; from 2.17.0, fixed in 2.18.11; from 2.19.0, fixed in 2.21.7; from 2.22.0, fixed in 2.22.3.
Fixed in 2.18.11 (released Sep 20, 2026, 2 days before disclosure), 2.21.7 (released Sep 21, 2026, 1 day before disclosure) and 2.22.3 (released Sep 21, 2026, 1 day before disclosure).
The latest release, 2.23.0, is not affected.
CVE-2026-68494High 8.7
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
Affected: from 2.15.0, fixed in 2.18.8; from 2.19.0, fixed in 2.21.4; fixed in 2.18.8; from 2.19.0, fixed in 2.21.4.
Fixed in 2.18.8 (released May 29, 2026, 67 days before disclosure) and 2.21.4 (released May 29, 2026, 67 days before disclosure).
The latest release, 2.23.0, is not affected.
CVE-2026-18401Medium 6.9
jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service
Affected: from 2.15.0, through 2.18.5; from 2.19.0, fixed in 2.21.1; from 2.19.0, fixed in 2.21.1; from 2.15.0, fixed in 2.18.6.
Fixed in 2.18.6 (released Feb 22, 2026, 163 days before disclosure) and 2.21.1 (released Feb 23, 2026, 162 days before disclosure).
The latest release, 2.23.0, is not affected.
CVE-2025-52999High 8.7
jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data
Affected: fixed in 2.15.0.
Fixed in 2.15.0 (released Apr 23, 2023, 794 days before disclosure).
The latest release, 2.23.0, is not affected.
CVE-2025-49128Medium 4.0
Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation
Affected: from 2.0.0, fixed in 2.13.0.
Fixed in 2.13.0 (released Sep 30, 2021, 1345 days before disclosure).
The latest release, 2.23.0, is not affected.