Skip to content

24.7.15

24.7.15: chore: Update Jackson version to 2.22.3 (24.7) (#26205)
@ZheSun88 ZheSun88 tagged this 07 Oct 05:43 
[CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425)
_jackson-core: UTF8DataInputJsonParser.reportInvalidToken() missing
maxErrorTokenLength limit - unbounded StringBuilder growth (DoS)
(osv-bomber,osv-scan)
[CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407)
jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT
via looksLikeValidNumber() (osv-bomber,osv-scan)

[CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777)
jackson-databind quadratic forward-reference completion
(osv-bomber,osv-scan)
[CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776)
jackson-databind retains every unknown raw type ID (osv-bomber,osv-scan)
Assets 2
Loading