Summary
[2.21.6-1.2]
- Resolves: RHEL-286626
- CVE-2026-89425 jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing
unbounded StringBuilder growth during malformed token processing
[2.21.6-1.1]
- Resolves: RHEL-272199
- Fix CVE-2026-89407
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | pki-jackson-core | 0:2.21.6-1.el9_8.2 |
Vulnerabilities 2
-
High 7.5
jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PAT…
-
High 7.5
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth
UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser impleme…