Jackson Release 2.18.10

Patch version of 2.18, released on August 15, 2026.

Following fixes are included in this patch release.

Changes, core

Streaming

• #1642: Fix maxDocumentLength bypass in async parser single-feedInput() case [GHSA-2c4j-63jj-9fqr]
• #1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser [CVE-2026-68498]

Databind

• #6099: Resolve classes without initialization in TypeFactory.findClass()
• #6116: Reject non-ASCII digits in InetAddress literal validation
• #6127: Add StreamReadConstraints number len constraint to javax.xml.datatype.GregorianCalendar and javax.xml.datatype.Duration [CVE-2026-68497]
• #6129: Limit the supported URL schemes for java.nio.file.Path deserialization [CVE-2026-19032]
• #6155: Add java.lang.Comparable as an "unsafe" polymorphic base type
• #6165: Apply number length limits to BigDecimal/BigInteger/Double/Float Map keys

Changes, dataformats

CBOR

• #725: Ensure maxNameLength limit enforced for CBOR parser [CVE-2026-68495]
• #727: CBORParser.nextFieldName(SerializableString) confuses 5-bit length marker 23 with 24 ("1-byte length follows")
• #728: CBORParser.nextFieldName(SerializableString) consumes Object entry slot twice on fast-path miss, truncating definite-length Objects
• #733: Stringref: Strings decoded by _finishLongText() not added to string-ref table, causing wrong values (or bogus "out of range" failures)
• #735: "stringref" property-name paths pass 5-bit length marker instead of actual length to shouldReferenceString()
• #736: Long Object property names added to "stringref" reference table twice

Smile

• #726: Ensure maxNameLength limit enforced for Smile parser [CVE-2026-68496]

TOML

• #702: Expand TOML dotted key nesting checks

XML

• #891: Enforce StreamReadConstraints.maxNestingDepth in FromXmlParser

Changes, Other modules

Java 8 Date/time

• #387: Validate length of input in InstantDeserializer