Most recent entries from all

certfr-2026-avi-0621 — De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un at…

certfr-2026-avi-0621

Withdrawn: CLEANSTART-2026-AK34966 — Security fixes in sonarqube 26.3.0.120487-r5

Withdrawn by the publisher.

Affected: CleanStart: sonarqube

Package sonarqube version 26.3.0.120487-r5 fixes 2 vulnerabilities: CVE-2026-29062, CVE-2026-54518

EUVD-2026-337367

fkie_cve-2026-29062

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.

GHSA-6v53-7c9g-w56r — jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion

Affected: Maven: tools.jackson.core:jackson-core

### Summary The `UTF8DataInputJsonParser`, which is used when parsing from a `java.io.DataInput` source, bypasses the `maxNestingDepth` constraint (default: 500) defined in `StreamReadConstraints`.

A similar issue was found in `ReaderBasedJsonParser`.

This allows a user to supply a JSON document with excessive nesting, which can cause a `StackOverflowError` when the structure is processed, leading to a Denial of Service (DoS).

The related fix for com.fasterxml.jackson.core:jackson-core, CVE-2025-52999, was not fully applied to tools.jackson.core:jackson-core until the 3.1.0 release. It is recommended that 3.0.x users upgrade.

### Patches jackson-core contains a configurable limit for how deep Jackson will traverse in an input document. This check was missing in a few places in tools.jackson.core:jackson-core.

The change is in https://github.com/FasterXML/jackson-core/pull/1554. jackson-core will throw a StreamConstraintsException if the limit is reached.

jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs.

### Workarounds Users should avoid parsing input files from untrusted sources.

### Resources [GHSA-6v53-7c9g-w56r](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-6v53-7c9g-w56r) https://nvd.nist.gov/vuln/detail/CVE-2025-52999 https://github.com/FasterXML/jackson-core/pull/1554

UBUNTU-CVE-2026-29062

Affected: Ubuntu:16.04:LTS: jackson-core, Ubuntu:18.04:LTS: jackson-core, Ubuntu:20.04:LTS: jackson-core, Ubuntu:22.04:LTS: jackson-core, Ubuntu:24.04:LTS: jackson-core, Ubuntu:25.10: jackson-core, Ubuntu:26.04:LTS: jackson-core

WID-SEC-W-2026-0624 — FasterXML Jackson: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und potenziell Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in FasterXML Jackson ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und potenziell um einen Denial of Service Angriff durchzuführen.