RLSA-2026:98493: Important: jackson-core security update
Core part of Jackson that defines Streaming API as well as basic shared abstractions.
Security Fix(es):
com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)
com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/pki-jackson-coreto a version that resolves this vulnerability.Fixed in 0:2.21.6-1.el9_9.1
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-based exploitation with no privileges required and no user interaction.
What is the expected security impact?
The reported impact is denial of service, affecting availability. The CVSS vector indicates no confidentiality or integrity impact and no scope change.
What kinds of input are associated with the flaws?
One issue involves regular-expression backtracking, and the other involves unbounded StringBuilder growth while processing malformed tokens. Both conditions can lead to denial of service.