https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:13:37 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:12280 <p><strong>Affected:</strong> AlmaLinux:9: pki-jackson-annotations, AlmaLinux:9: pki-jackson-core, AlmaLinux:9: pki-jackson-databind, AlmaLinux:9: pki-jackson-jaxrs-json-provider, AlmaLinux:9: pki-jackson-jaxrs-providers, AlmaLinux:9: pki-jackson-module-jaxb-annotations</p> <p>Core part of Jackson that defines Streaming API as well as basic shared abstractions.</p> <p>Security Fix(es):</p> <p>* com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError (CVE-2025-52999)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: pki-jackson-annotations, AlmaLinux:9: pki-jackson-core, AlmaLinux:9: pki-jackson-databind, AlmaLinux:9: pki-jackson-jaxrs-json-provider, AlmaLinux:9: pki-jackson-jaxrs-providers, AlmaLinux:9: pki-jackson-module-jaxb-annotations</p> <p>Core part of Jackson that defines Streaming API as well as basic shared abstractions.</p> <p>Security Fix(es):</p> <p>* com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError (CVE-2025-52999)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:12280 https://cve.radiocsirt.org/vuln/bdu:2025-11087 bdu:2025-11087 https://cve.radiocsirt.org/vuln/bdu:2025-11087 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0754 certfr-2025-avi-0754 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0754 https://cve.radiocsirt.org/vuln/cleanstart-2026-cf06415 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: apache-hive</p> <p>Package apache-hive version 4.2.0-r7 fixes 8 vulnerabilities: CVE-2025-52999, CVE-2025-49128, CVE-2026-43869, ghsa-72hv-8253-57qq, ghsa-5jmj-h7xm-6q6v...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: apache-hive</p> <p>Package apache-hive version 4.2.0-r7 fixes 8 vulnerabilities: CVE-2025-52999, CVE-2025-49128, CVE-2026-43869, ghsa-72hv-8253-57qq, ghsa-5jmj-h7xm-6q6v...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-cf06415 https://cve.radiocsirt.org/vuln/euvd-2026-245860 EUVD-2026-245860 https://cve.radiocsirt.org/vuln/euvd-2026-245860 https://cve.radiocsirt.org/vuln/fkie_cve-2025-52999 <p>jackson-core contains core low-level incremental (&#34;streaming&#34;) parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.</p> <p>jackson-core contains core low-level incremental (&#34;streaming&#34;) parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-52999 https://cve.radiocsirt.org/vuln/ghsa-h46c-h94j-95f3 <p><strong>Affected:</strong> Maven: com.fasterxml.jackson.core:jackson-core</p> <p>### Impact With older versions of jackson-core, if you parse an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large.</p> <p>### Patches jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. Change is in https://github.com/FasterXML/jackson-core/pull/943. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs.</p> <p>### Workarounds Users should avoid parsing input files from untrusted sources.</p> <p><strong>Affected:</strong> Maven: com.fasterxml.jackson.core:jackson-core</p> <p>### Impact With older versions of jackson-core, if you parse an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large.</p> <p>### Patches jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. Change is in https://github.com/FasterXML/jackson-core/pull/943. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs.</p> <p>### Workarounds Users should avoid parsing input files from untrusted sources.</p> https://cve.radiocsirt.org/vuln/ghsa-h46c-h94j-95f3 https://cve.radiocsirt.org/vuln/ncsc-2026-0028 NCSC-2026-0028 https://cve.radiocsirt.org/vuln/ncsc-2026-0028 https://cve.radiocsirt.org/vuln/rhsa-2025:10092 <p>json-smart: Potential DoS via stack exhaustion (incomplete fix for CVE-2023-1370) jetty-http2-common: Jetty HTTP/2 Header List Size Vulnerability spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError</p> <p>json-smart: Potential DoS via stack exhaustion (incomplete fix for CVE-2023-1370) jetty-http2-common: Jetty HTTP/2 Header List Size Vulnerability spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError</p> https://cve.radiocsirt.org/vuln/rhsa-2025:10092 https://cve.radiocsirt.org/vuln/rhsa-2025:12280 <p>com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError</p> <p>com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError</p> https://cve.radiocsirt.org/vuln/rhsa-2025:12280 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-52999 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: jackson-core, Ubuntu:18.04:LTS: jackson-core, Ubuntu:20.04:LTS: jackson-core, Ubuntu:22.04:LTS: jackson-core, Ubuntu:24.04:LTS: jackson-core, Ubuntu:25.10: jackson-core, Ubuntu:26.04:LTS: jackson-core</p> <p>jackson-core contains core low-level incremental (&#34;streaming&#34;) parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: jackson-core, Ubuntu:18.04:LTS: jackson-core, Ubuntu:20.04:LTS: jackson-core, Ubuntu:22.04:LTS: jackson-core, Ubuntu:24.04:LTS: jackson-core, Ubuntu:25.10: jackson-core, Ubuntu:26.04:LTS: jackson-core</p> <p>jackson-core contains core low-level incremental (&#34;streaming&#34;) parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-52999 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1405 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in FasterXML Jackson ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in FasterXML Jackson ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1405