Read the docs
TI-2026-75533 Aliases CVE-2026-68498

Delayed name length check in jackson-core enables memory exhaustion

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 12 fixed, 17 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

jackson-core from 2.16.0 before 2.18.10, from 2.19.0 before 2.21.6 and from 2.22.0 before 2.22.2, and tools.jackson.core from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2, are affected. For String, Reader and char[] input, the maxNameLength limit is not enforced while a property name is read, so the name is buffered up to maxStringLength. A remote unauthenticated attacker can send a very long property name to exhaust heap memory and crash the process.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default. In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory. A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration. Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes. This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00652 51st percentileScored 2026-11-07
Fix Partial jackson-core (FasterXML): 2.18.10, 2.21.6, 2.22.2 +2Red Hat: 12 advisoriesRed Hat: 12 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FasterXMLjackson-core2.16.0 to before 2.18.10; 2.19.0 to before 2.21.6; 2.22.0 to before 2.22.22.18.10, 2.21.6, 2.22.2Patch availableCNA
FasterXMLjackson-core3.0.0 to before 3.1.6; 3.2.0 to before 3.2.23.1.6, 3.2.2Patch availableCNA
  • jackson-core VendorFasterXML Affected 2.16.0 to before 2.18.10; 2.19.0 to before 2.21.6; 2.22.0 to before 2.22.2 Fixed in 2.18.10, 2.21.6, 2.22.2 Patch available CNA
  • jackson-core VendorFasterXML Affected 3.0.0 to before 3.1.6; 3.2.0 to before 3.2.2 Fixed in 3.1.6, 3.2.2 Patch available CNA

Remediation

Upgrade jackson-core to 2.18.10, 2.21.6 or 2.22.2, or tools.jackson.core to 3.1.6 or 3.2.2. Red Hat fixes OpenShift Developer Tools and Services 4.12 through 4.22 in RHSA-2026:88149, 88150, 88151, 88152, 88153, 88154, 88155, 88156, 88157, 88158 and 88159, and Red Hat Enterprise Linux AppStream 8 in RHSA-2026:90909. Red Hat plans no fix for Red Hat AI Inference Server and Red Hat JBoss Enterprise Application Platform 7, and has no fix available for other affected Red Hat products.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA jackson-core (FasterXML) Fixed in 2.18.10, 2.21.6, 2.22.2
  • Fix · CNA jackson-core (FasterXML) Fixed in 3.1.6, 3.2.2

Red Hat 12 advisories

  • RHSA-2026:90909 Released 2026-10-27 · Red Hat rating Important
    pki-deps:10.6 security update
    • Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.10.0+20993+d0f024b0.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.10.0+20993+d0f024b0.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.10.0+20993+d0f024b0.noarch::pki-deps:10.6 +47
  • RHSA-2026:88159 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88158 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 9 more Red Hat advisories
  • RHSA-2026:88157 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88156 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88155 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88154 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88153 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88151 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88152 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88149 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88150 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Build of KeycloakAffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet
Red Hat JBoss Web Server 7AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:88152
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:88149
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:88151
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:88150
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:88156
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:88159
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:88153
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:88158
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:88157
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:88155
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:88154
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:90909
Not affected: 33 products
  • OpenShift Developer Tools and Services
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • OpenShift Serverless
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ceph Storage 7
  • Red Hat Ceph Storage 8
  • Red Hat Ceph Storage 9
  • Red Hat Certificate System 10
  • Red Hat Certificate System 11
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Lightspeed for Runtimes Operator
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenStack Platform 16.2
  • Red Hat Satellite 6
  • Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-68498
  2. 2026-10-18 Affected versions changed · Red Hat
  3. 2026-10-18 CVSS score added · Red Hat
  4. 2026-10-18 Priority changed: MEDIUM → LOW
  5. 2026-10-20 CISA SSVC decision points changed
  6. 2026-10-20 Priority changed: LOW → MEDIUM
  7. 2026-10-21 Affected versions changed · Red Hat
  8. 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
  9. 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
  10. 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
  11. 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
  12. 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
  15. 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
  16. 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
  17. 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
  18. 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
  19. 2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +8 · Red Hat
  20. 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream (v. 8) · Red Hat
  21. 2026-10-29 Fix available: RHSA-2026:90909 · Red Hat
  22. 2026-10-30 Affected versions changed · Red Hat
  23. 2026-11-04 Affected versions changed · Red Hat
  24. 2026-11-05 Affected versions changed · Red Hat

References

Patch 2

Advisory 1

Other 2

  • TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
  • TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
  • TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
  • TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences