synced JUST NOW
01 Record

CVE-2026-89425

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

HighPUBLISHEDCNA: HeroDevs
CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
View raw JSON

02 Description

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

03 Exploitation and scoring

Exploitation
Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.
SSVC decision
  • ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
  • AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
  • Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.
EPSS probability
0.53% probability of exploitation activity in the next 30 days.
EPSS percentile
Equal to or higher than the score of 44.6% of scored records. A rank, not a probability.
NVD base score
7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD analysis status
Deferred. NVD last modified this record on 2026-09-24.
Red Hat severity
Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published
2026-09-23 02:06Z1 MO AGO
Last updated
2026-09-23 14:00Z1 MO AGO
Reserved
2026-09-11
Assigning CNA
HeroDevs
Record state
PUBLISHED
Severity
High (CVSS 7.5)
CNA CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
  • CWE-400Uncontrolled Resource ConsumptionClass
  • CWE-770Allocation of Resources Without Limits or ThrottlingBase
  • CWE-1050Excessive Platform Resource Consumption within a LoopBase
Data version
5.2
Document digest
8b38ef6947b17231b2ebbdc61f325a62be1d1ded0fa6afccd601993c253f6d7d

05 Affected products

VendorProductVersionsPlatforms
FasterXMLjackson-core2.8.0 to 2.18.10, 2.19.0 to 2.21.6, 2.22.0 to 2.22.2, 3.0.0 to 3.1.6, 3.2.0 to 3.2.2—

06 References

07 Remediation

Upgrade to com.fasterxml.jackson.core:jackson-core 2.18.11, 2.21.7 or 2.22.3, or to tools.jackson.core:jackson-core 3.1.7 or 3.2.3. The 2.8.x through 2.17.x, 2.19.x, 2.20.x and 3.0.x lines received no fix on their own branch and are no longer maintained upstream; consumers of those lines must move forward to a maintained release.

08 Fixed in

AlmaLinux 8

  • apache-commons-collections
    Fixed in 3.2.2-10.module_el8.5.0+2577+9e95fe00
  • apache-commons-lang
    Fixed in 2.6-21.module_el8.5.0+2577+9e95fe00
  • apache-commons-net
    Fixed in 3.6-3.module_el8.5.0+2577+9e95fe00
  • bea-stax-api
    Fixed in 1.2.0-16.module_el8.5.0+2577+9e95fe00
  • glassfish-fastinfoset
    Fixed in 1.2.13-9.module_el8.5.0+2577+9e95fe00
  • glassfish-jaxb-api
    Fixed in 2.2.12-8.module_el8.5.0+2577+9e95fe00
  • glassfish-jaxb-core
    Fixed in 2.2.11-12.module_el8.10.0+3791+e0637953
  • glassfish-jaxb-runtime
    Fixed in 2.2.11-12.module_el8.10.0+3791+e0637953
  • glassfish-jaxb-txw2
    Fixed in 2.2.11-12.module_el8.10.0+3791+e0637953
  • jackson-annotations
    Fixed in 2.21-1.module_el8.10.0+4235+0924958e
  • jackson-core
    Fixed in 2.21.4-1.module_el8.10.0+4329+908ad137.3
  • jackson-databind
    Fixed in 2.21.4-1.module_el8.10.0+4329+908ad137.1
  • jackson-jaxrs-json-provider
    Fixed in 2.21.4-1.module_el8.10.0+4235+0924958e
  • jackson-jaxrs-providers
    Fixed in 2.21.4-1.module_el8.10.0+4235+0924958e
  • jackson-module-jaxb-annotations
    Fixed in 2.21.4-2.module_el8.10.0+4235+0924958e
  • jakarta-commons-httpclient
    Fixed in 1:3.1-28.module_el8.5.0+2577+9e95fe00
  • javassist
    Fixed in 3.18.1-8.module_el8.5.0+2577+9e95fe00
  • javassist-javadoc
    Fixed in 3.18.1-8.module_el8.5.0+2577+9e95fe00
  • pki-servlet-engine
    Fixed in 1:9.0.62-1.module_el8.10.0+3791+e0637953
  • relaxngDatatype
    Fixed in 2011.1-7.module_el8.5.0+2577+9e95fe00
  • slf4j
    Fixed in 1.7.25-4.module_el8.5.0+2577+9e95fe00
  • slf4j-jdk14
    Fixed in 1.7.25-4.module_el8.5.0+2577+9e95fe00
  • stax-ex
    Fixed in 1.7.7-8.module_el8.5.0+2577+9e95fe00
  • velocity
    Fixed in 1.7-24.module_el8.5.0+2577+9e95fe00
  • xalan-j2
    Fixed in 2.7.1-38.module_el8.5.0+2577+9e95fe00
  • xerces-j2
    Fixed in 2.11.0-34.module_el8.5.0+2577+9e95fe00
  • xml-commons-apis
    Fixed in 1.4.01-25.module_el8.5.0+2577+9e95fe00
  • xml-commons-resolver
    Fixed in 1.2-26.module_el8.5.0+2577+9e95fe00
  • xmlstreambuffer
    Fixed in 1.5.4-8.module_el8.5.0+2577+9e95fe00
  • xsom
    Fixed in 0-19.20110809svn.module_el8.5.0+2577+9e95fe00

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

AlmaLinux 9

  • pki-jackson-core
    Fixed in 2.21.6-1.el9_8.2

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 8

  • apache-commons-collections
    Fixed in 3.2.2-10.module_el8.5.0+2577+9e95fe00
  • apache-commons-lang
    Fixed in 2.6-21.module_el8.5.0+2577+9e95fe00
  • apache-commons-net
    Fixed in 3.6-3.module_el8.5.0+2577+9e95fe00
  • bea-stax-api
    Fixed in 1.2.0-16.module_el8.5.0+2577+9e95fe00
  • glassfish-fastinfoset
    Fixed in 1.2.13-9.module_el8.5.0+2577+9e95fe00
  • glassfish-jaxb-api
    Fixed in 2.2.12-8.module_el8.5.0+2577+9e95fe00
  • glassfish-jaxb-core
    Fixed in 2.2.11-12.module_el8.10.0+3791+e0637953
  • glassfish-jaxb-runtime
    Fixed in 2.2.11-12.module_el8.10.0+3791+e0637953
  • glassfish-jaxb-txw2
    Fixed in 2.2.11-12.module_el8.10.0+3791+e0637953
  • jackson-annotations
    Fixed in 2.21-1.module_el8.10.0+4235+0924958e
  • jackson-core
    Fixed in 2.21.4-1.module_el8.10.0+4329+908ad137.3
  • jackson-databind
    Fixed in 2.21.4-1.module_el8.10.0+4329+908ad137.1
  • jackson-jaxrs-json-provider
    Fixed in 2.21.4-1.module_el8.10.0+4235+0924958e
  • jackson-jaxrs-providers
    Fixed in 2.21.4-1.module_el8.10.0+4235+0924958e
  • jackson-module-jaxb-annotations
    Fixed in 2.21.4-2.module_el8.10.0+4235+0924958e
  • jakarta-commons-httpclient
    Fixed in 1:3.1-28.module_el8.5.0+2577+9e95fe00
  • javassist
    Fixed in 3.18.1-8.module_el8.5.0+2577+9e95fe00
  • javassist-javadoc
    Fixed in 3.18.1-8.module_el8.5.0+2577+9e95fe00
  • pki-servlet-engine
    Fixed in 1:9.0.62-1.module_el8.10.0+3791+e0637953
  • relaxngDatatype
    Fixed in 2011.1-7.module_el8.5.0+2577+9e95fe00
  • slf4j
    Fixed in 1.7.25-4.module_el8.5.0+2577+9e95fe00
  • slf4j-jdk14
    Fixed in 1.7.25-4.module_el8.5.0+2577+9e95fe00
  • stax-ex
    Fixed in 1.7.7-8.module_el8.5.0+2577+9e95fe00
  • velocity
    Fixed in 1.7-24.module_el8.5.0+2577+9e95fe00
  • xalan-j2
    Fixed in 2.7.1-38.module_el8.5.0+2577+9e95fe00
  • xerces-j2
    Fixed in 2.11.0-34.module_el8.5.0+2577+9e95fe00
  • xml-commons-apis
    Fixed in 1.4.01-25.module_el8.5.0+2577+9e95fe00
  • xml-commons-resolver
    Fixed in 1.2-26.module_el8.5.0+2577+9e95fe00
  • xmlstreambuffer
    Fixed in 1.5.4-8.module_el8.5.0+2577+9e95fe00
  • xsom
    Fixed in 0-19.20110809svn.module_el8.5.0+2577+9e95fe00

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 9

  • pki-jackson-core
    Fixed in 2.21.6-1.el9_8.2

Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

Debian 12

  • jackson-core
    No fix yet

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

  • jackson-core
    No fix yet

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

  • jackson-core
    Fixed in 2.18.11-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 16.04 LTS

  • jackson-core
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

  • jackson-core
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 20.04 LTS

  • jackson-core
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 22.04 LTS

  • jackson-core
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 24.04 LTS

  • jackson-core
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 26.04 LTS

  • jackson-core
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 26.10

  • jackson-core
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.