FasterXML jackson-core

• CVE-2026-68498 High 7.5 jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service 0.7%
• CVE-2026-89425 High 7.5 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth 0.5%
• CVE-2026-89407 High 7.5 jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS 0.6%
• CVE-2026-68494 High 8.7 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) 0.5%
• CVE-2026-18401 Medium 6.9 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service 0.4%
• CVE-2026-29062 High 7.5 jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion 0.6%
• CVE-2025-52999 High 8.7 jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data 0.8%
• CVE-2025-49128 Medium 4.0 Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation 0.4%