RHLW-2026-7dcb1a44e2edeb0e: Lightwell Security Advisory: jackson-core 2.17.3.rhlw-00005
Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-core 2.17.3.rhlw-00005 with backported fixes for CVE-2026-18401, CVE-2026-68494, CVE-2026-89407, and CVE-2026-89425.
CVE-2026-18401: jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service
CVE-2026-68494: jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
CVE-2026-89407: jackson-core: quadratic backtracking in NumberInput.PATTERNFLOAT via looksLikeValidNumber() enables ReDoS
CVE-2026-89425: jackson-core: UTF8DataInputJsonParser.reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth
This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-core 2.17.3 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/com.fasterxml.jackson.core:jackson-coreto a version that resolves this vulnerability.Fixed in 2.17.3.rhlw-00005 - Upgrade
Upgrade
com.fasterxml.jackson.core:jackson-coreto a version that resolves this vulnerability.Fixed in 2.17.3.rhlw-00005
Event History
Child vulnerabilities
Contains the following vulnerabilities.