# com.fasterxml.jackson.core:jackson-core (Maven) vulnerabilities 6 known vulnerabilities (4 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.23.0 (Nov 8, 2026): no advisory affects it - Newest unaffected release: 2.23.0 (Nov 8, 2026), the latest release - Dependents: 4,998 - Releases: 198 since 2.0.0 (Mar 25, 2012) - Registry: https://central.sonatype.com/artifact/com.fasterxml.jackson.core/jackson-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-89425: 2.8.0 to 2.18.10 (2.18.11 is outside it); 2.19.0 to 2.21.6 (2.21.7 is outside it); 2.22.0 to 2.22.2 (2.22.3 is outside it) - CVE-2026-89407: 2.17.0 to 2.18.10 (2.18.11 is outside it); 2.19.0 to 2.21.6 (2.21.7 is outside it); 2.22.0 to 2.22.2 (2.22.3 is outside it) - CVE-2026-68494: 2.0.0-RC1 to 2.18.7 (2.18.8 is outside it); 2.19.0 to 2.21.3 (2.21.4 is outside it) - CVE-2026-18401: 2.15.0 to 2.18.5 (2.18.6 is outside it); 2.19.0 to 2.21.0 (2.21.1 is outside it) - CVE-2025-52999: 2.0.0-RC1 to 2.15.0-rc3 (2.15.0 is outside it) - CVE-2025-49128: 2.0.0 to 2.13.0-rc2 (2.13.0 is outside it) ## Advisories (6) ### [CVE-2026-89425](https://cve.now/CVE-2026-89425): jackson-core: UTF8DataInputJsonParser.\_reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth - Severity: High 7.5 - Published: Sep 23, 2026 - Affected: from 2.8.0, through 2.18.10; from 2.19.0, through 2.21.6; from 2.22.0, through 2.22.2; from 2.19.0, fixed in 2.21.7; from 2.22.0, fixed in 2.22.3; from 2.8.0, fixed in 2.18.11. - Fixed in 2.18.11 (released Sep 20, 2026, 3 days before disclosure), 2.21.7 (released Sep 21, 2026, 2 days before disclosure) and 2.22.3 (released Sep 21, 2026, 2 days before disclosure). - The latest release, 2.23.0, is not affected. ### [CVE-2026-89407](https://cve.now/CVE-2026-89407): jackson-core: quadratic backtracking in NumberInput.PATTERN\_FLOAT via looksLikeValidNumber() enables ReDoS - Severity: High 7.5 - Published: Sep 22, 2026 - Affected: from 2.17.0, through 2.18.10; from 2.19.0, through 2.21.6; from 2.22.0, through 2.22.2; from 2.17.0, fixed in 2.18.11; from 2.19.0, fixed in 2.21.7; from 2.22.0, fixed in 2.22.3. - Fixed in 2.18.11 (released Sep 20, 2026, 2 days before disclosure), 2.21.7 (released Sep 21, 2026, 1 day before disclosure) and 2.22.3 (released Sep 21, 2026, 1 day before disclosure). - The latest release, 2.23.0, is not affected. ### [CVE-2026-68494](https://cve.now/CVE-2026-68494): jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) - Severity: High 8.7 - Published: Aug 4, 2026 - Affected: from 2.15.0, fixed in 2.18.8; from 2.19.0, fixed in 2.21.4; fixed in 2.18.8; from 2.19.0, fixed in 2.21.4. - Fixed in 2.18.8 (released May 29, 2026, 67 days before disclosure) and 2.21.4 (released May 29, 2026, 67 days before disclosure). - The latest release, 2.23.0, is not affected. ### [CVE-2026-18401](https://cve.now/CVE-2026-18401): jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service - Severity: Medium 6.9 - Published: Aug 4, 2026 - Affected: from 2.15.0, through 2.18.5; from 2.19.0, fixed in 2.21.1; from 2.19.0, fixed in 2.21.1; from 2.15.0, fixed in 2.18.6. - Fixed in 2.18.6 (released Feb 22, 2026, 163 days before disclosure) and 2.21.1 (released Feb 23, 2026, 162 days before disclosure). - The latest release, 2.23.0, is not affected. ### [CVE-2025-52999](https://cve.now/CVE-2025-52999): jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data - Severity: High 8.7 - Published: Jun 25, 2025 - Affected: fixed in 2.15.0. - Fixed in 2.15.0 (released Apr 23, 2023, 794 days before disclosure). - The latest release, 2.23.0, is not affected. ### [CVE-2025-49128](https://cve.now/CVE-2025-49128): Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation - Severity: Medium 4.0 - Published: Jun 6, 2025 - Affected: from 2.0.0, fixed in 2.13.0. - Fixed in 2.13.0 (released Sep 30, 2021, 1345 days before disclosure). - The latest release, 2.23.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/com.fasterxml.jackson.core:jackson-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.