Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

tools.jackson.core:jackson-core

5 known vulnerabilities (4 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
3.3.0 (Nov 8, 2026): no advisory affects it
Newest unaffected release
3.3.0 (Nov 8, 2026), the latest release
Advisories
5 · 4 high, 1 medium
Dependents
1,439
Releases
31 since 3.0.0 (Oct 3, 2025)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-89425
    Affects 3.0.0 to 3.1.6 (3.1.7 is outside it); 3.2.0 to 3.2.2 (3.2.3 is outside it)
  • CVE-2026-89407
    Affects 3.0.0 to 3.1.6 (3.1.7 is outside it); 3.2.0 to 3.2.1 (3.2.2 is outside it)
  • CVE-2026-68494
    Affects 3.0.0 to 3.1.3 (3.1.4 is outside it)
  • CVE-2026-18401
    Affects 3.0.0 to 3.1.0-rc1 (3.1.0 is outside it)
  • CVE-2026-29062
    Affects 3.0.0 to 3.1.0-rc1 (3.1.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

    Affected: from 3.0.0, through 3.1.6; from 3.2.0, through 3.2.2; from 3.0.0, fixed in 3.1.7; from 3.2.0, fixed in 3.2.3.

    Fixed in 3.1.7 (released Sep 21, 2026, 2 days before disclosure) and 3.2.3 (released Sep 22, 2026, 1 day before disclosure).

    The latest release, 3.3.0, is not affected.

  • jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS

    Affected: from 3.0.0, through 3.1.6; from 3.2.0, through 3.2.1; from 3.0.0, fixed in 3.1.7; from 3.2.0, fixed in 3.2.2.

    Fixed in 3.1.7 (released Sep 21, 2026, 1 day before disclosure) and 3.2.2 (released Aug 14, 2026, 39 days before disclosure).

    The latest release, 3.3.0, is not affected.

  • jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

    Affected: from 3.0.0, fixed in 3.1.4; from 3.0.0, fixed in 3.1.4.

    Fixed in 3.1.4 (released May 29, 2026, 67 days before disclosure).

    The latest release, 3.3.0, is not affected.

  • CVE-2026-18401Medium 6.9

    jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service

    Affected: from 3.0.0, fixed in 3.1.0; from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Feb 23, 2026, 162 days before disclosure).

    The latest release, 3.3.0, is not affected.

  • jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Feb 23, 2026, 11 days before disclosure).

    The latest release, 3.3.0, is not affected.