https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T21:15:20.615007+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2025:12280 ALSA-2025:12280 — Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base secur… 2026-10-03T21:15:21.364207+00:00

Affected: AlmaLinux:9: pki-jackson-annotations, AlmaLinux:9: pki-jackson-core, AlmaLinux:9: pki-jackson-databind, AlmaLinux:9: pki-jackson-jaxrs-json-provider, AlmaLinux:9: pki-jackson-jaxrs-providers, AlmaLinux:9: pki-jackson-module-jaxb-annotations

Core part of Jackson that defines Streaming API as well as basic shared abstractions.

Security Fix(es):

* com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError (CVE-2025-52999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2025-11087 bdu:2025-11087 2026-10-03T21:15:21.364305+00:00 bdu:2025-11087 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0754 certfr-2025-avi-0754 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-03T21:15:21.364330+00:00 certfr-2025-avi-0754 https://cve.radiocsirt.org/vuln/cleanstart-2026-cf06415 Withdrawn: CLEANSTART-2026-CF06415 — Security fixes in apache-hive 4.2.0-r7 2026-10-03T21:15:21.364349+00:00

Withdrawn by the publisher.

Affected: CleanStart: apache-hive

Package apache-hive version 4.2.0-r7 fixes 8 vulnerabilities: CVE-2025-52999, CVE-2025-49128, CVE-2026-43869, ghsa-72hv-8253-57qq, ghsa-5jmj-h7xm-6q6v...

 https://cve.radiocsirt.org/vuln/euvd-2026-245860 EUVD-2026-245860 2026-10-03T21:15:21.364372+00:00 EUVD-2026-245860 https://cve.radiocsirt.org/vuln/fkie_cve-2025-52999 fkie_cve-2025-52999 2026-10-03T21:15:21.364385+00:00

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.

 https://cve.radiocsirt.org/vuln/ghsa-h46c-h94j-95f3 GHSA-h46c-h94j-95f3 — jackson-core can throw a StackoverflowError when processing deeply nested data 2026-10-03T21:15:21.364410+00:00

Affected: Maven: com.fasterxml.jackson.core:jackson-core

### Impact With older versions of jackson-core, if you parse an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large.

### Patches jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. Change is in https://github.com/FasterXML/jackson-core/pull/943. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs.

### Workarounds Users should avoid parsing input files from untrusted sources.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0028 NCSC-2026-0028 — Kwetsbaarheden verholpen in Oracle Analytics 2026-10-03T21:15:21.364435+00:00 NCSC-2026-0028 https://cve.radiocsirt.org/vuln/rhsa-2025:10092 RHSA-2025:10092 — Red Hat Security Advisory: Red Hat Product OCP Tools 4.18 OpenShift Jenkins security update 2026-10-03T21:15:21.364463+00:00

json-smart: Potential DoS via stack exhaustion (incomplete fix for CVE-2023-1370) jetty-http2-common: Jetty HTTP/2 Header List Size Vulnerability spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError

 https://cve.radiocsirt.org/vuln/rhsa-2025:12280 RHSA-2025:12280 — Red Hat Security Advisory: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-mo… 2026-10-03T21:15:21.364485+00:00

com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-52999 UBUNTU-CVE-2025-52999 2026-10-03T21:15:21.364502+00:00

Affected: Ubuntu:16.04:LTS: jackson-core, Ubuntu:18.04:LTS: jackson-core, Ubuntu:20.04:LTS: jackson-core, Ubuntu:22.04:LTS: jackson-core, Ubuntu:24.04:LTS: jackson-core, Ubuntu:25.10: jackson-core, Ubuntu:26.04:LTS: jackson-core

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1405 WID-SEC-W-2025-1405 — FasterXML Jackson: Schwachstelle ermöglicht Denial of Service 2026-10-03T21:15:21.364534+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in FasterXML Jackson ausnutzen, um einen Denial of Service Angriff durchzuführen.