https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T21:59:23.672557+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0621 certfr-2026-avi-0621 — De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un at… 2026-10-02T21:59:23.792788+00:00 certfr-2026-avi-0621 https://cve.radiocsirt.org/vuln/cleanstart-2026-ak34966 Withdrawn: CLEANSTART-2026-AK34966 — Security fixes in sonarqube 26.3.0.120487-r5 2026-10-02T21:59:23.792847+00:00

Withdrawn by the publisher.

Affected: CleanStart: sonarqube

Package sonarqube version 26.3.0.120487-r5 fixes 2 vulnerabilities: CVE-2026-29062, CVE-2026-54518

 https://cve.radiocsirt.org/vuln/euvd-2026-337367 EUVD-2026-337367 2026-10-02T21:59:23.792888+00:00 EUVD-2026-337367 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29062 fkie_cve-2026-29062 2026-10-02T21:59:23.792902+00:00

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.

 https://cve.radiocsirt.org/vuln/ghsa-6v53-7c9g-w56r GHSA-6v53-7c9g-w56r — jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion 2026-10-02T21:59:23.792929+00:00

Affected: Maven: tools.jackson.core:jackson-core

### Summary The `UTF8DataInputJsonParser`, which is used when parsing from a `java.io.DataInput` source, bypasses the `maxNestingDepth` constraint (default: 500) defined in `StreamReadConstraints`.

A similar issue was found in `ReaderBasedJsonParser`.

This allows a user to supply a JSON document with excessive nesting, which can cause a `StackOverflowError` when the structure is processed, leading to a Denial of Service (DoS).

The related fix for com.fasterxml.jackson.core:jackson-core, CVE-2025-52999, was not fully applied to tools.jackson.core:jackson-core until the 3.1.0 release. It is recommended that 3.0.x users upgrade.

### Patches jackson-core contains a configurable limit for how deep Jackson will traverse in an input document. This check was missing in a few places in tools.jackson.core:jackson-core.

The change is in https://github.com/FasterXML/jackson-core/pull/1554. jackson-core will throw a StreamConstraintsException if the limit is reached.

jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs.

### Workarounds Users should avoid parsing input files from untrusted sources.

### Resources [GHSA-6v53-7c9g-w56r](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56r) https://nvd.nist.gov/vuln/detail/CVE-2025-52999 https://github.com/FasterXML/jackson-core/pull/1554

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-29062 UBUNTU-CVE-2026-29062 2026-10-02T21:59:23.792964+00:00

Affected: Ubuntu:16.04:LTS: jackson-core, Ubuntu:18.04:LTS: jackson-core, Ubuntu:20.04:LTS: jackson-core, Ubuntu:22.04:LTS: jackson-core, Ubuntu:24.04:LTS: jackson-core, Ubuntu:25.10: jackson-core, Ubuntu:26.04:LTS: jackson-core

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0624 WID-SEC-W-2026-0624 — FasterXML Jackson: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und potenziell Denial of Service 2026-10-02T21:59:23.792996+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in FasterXML Jackson ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und potenziell um einen Denial of Service Angriff durchzuführen.