RHSA-2026:98493: Important: jackson-core security update
Core part of Jackson that defines Streaming API as well as basic shared abstractions.Security Fix(es): com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407) com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jackson-coreto a version that resolves this vulnerability.Fixed in 2.21.6-1.el9_9.1 - Upgrade
Upgrade
redhat/pki-jackson-coreto a version that resolves this vulnerability.Fixed in 2.21.6-1.el9_9.1
Event History
Frequently Asked Questions
What kinds of denial-of-service conditions are addressed by this update?
The update addresses regular-expression backtracking that can cause denial of service, and unbounded StringBuilder growth while processing malformed tokens. Both issues affect jackson-core.
Which Red Hat software packages are identified as affected by this advisory?
The advisory identifies redhat/jackson-core and redhat/pki-jackson-core.