Red Hat Security AdvisoryRHSA-2026:86706
jackson-core security update
Released 2026-10-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) jackson-core-2.21.6-1.el9_8.2, pki-jackson-core-2.21.6-1.el9_8.2
Fixes 2 records
Priority HIGH 72
UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00532 · Published 2026-09-23 · Partial fix · 2.21.7, 2.22.3 +3 CWE-400
Priority HIGH 72
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_F…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00628 · Published 2026-09-22 · Partial fix · 2.18.11, 2.21.7 +3 CWE-1333
