Skip to content
OpenAdvisories

Package · Maven

com.fasterxml.jackson.core:jackson-core

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-18401

    jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service

    The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can suppl…

    FasterXML jackson-core druid thingsboard-tb-node Ubuntu Wolfi Maven
  • Medium 4.0
    CVE-2025-49128

    Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation

    Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's `JsonLocation._appendSourceDesc` method allows up …

    FasterXML jackson-core druid tez Debian Ubuntu Wolfi Maven