Skip to content
Fencer Intel
high 7.5

CVE-2026-68498 json

jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service

published 2mo ago modified 22d ago also EUVD-2026-103177 , GHSA-649p-m576-vr99

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository FasterXML/jackson-core. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.

In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.

A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.

Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.

This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.

Patch / fix

  • FasterXML jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2
  • jackson-core Debian 14 2.18.11-1

debian advisories DEBIAN-CVE-2026-68498

  • jackson-databind SLES for SAP applications 16.0, SLES 16.0 2.18.11-160000.1.1
  • jackson-core SLES for SAP applications 16.0, SLES 16.0 2.18.11-160000.1.1
  • jackson-annotations SLES for SAP applications 16.0, SLES 16.0 2.18.11-160000.1.1
  • jackson-core SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.11-150200.3.30.1
  • jackson-databind SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.11-150200.3.36.1
  • jackson-annotations SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.11-150200.3.28.1
  • jackson-dataformat-xml SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.11-150200.5.8.1
  • jackson-dataformats-binary SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.11-150200.3.29.1

suse advisories SUSE-SU-2026:24149-1SUSE-SU-2026:4394-1

  • jackson-databind openSUSE Leap 16.0 2.18.11-160000.1.1
  • jackson-core openSUSE Leap 16.0 2.18.11-160000.1.1
  • jackson-annotations openSUSE Leap 16.0 2.18.11-160000.1.1
  • jackson-core openSUSE Tumbleweed 2.18.11-1.1

opensuse advisories openSUSE-SU-2026:22034-1openSUSE-SU-2026:11876-1

  • xsom AlmaLinux 8 0-19.20110809svn.module_el8.5.0+2577+9e95fe00
  • slf4j AlmaLinux 8 1.7.25-4.module_el8.5.0+2577+9e95fe00
  • stax-ex AlmaLinux 8 1.7.7-8.module_el8.5.0+2577+9e95fe00
  • velocity AlmaLinux 8 1.7-24.module_el8.5.0+2577+9e95fe00
  • xalan-j2 AlmaLinux 8 2.7.1-38.module_el8.5.0+2577+9e95fe00
  • javassist AlmaLinux 8 3.18.1-8.module_el8.5.0+2577+9e95fe00
  • xerces-j2 AlmaLinux 8 2.11.0-34.module_el8.5.0+2577+9e95fe00
  • slf4j-jdk14 AlmaLinux 8 1.7.25-4.module_el8.5.0+2577+9e95fe00

almalinux advisories ALSA-2026:90909

  • xsom Rocky Linux 8 0-19.20110809svn.module+el8.10.0+1763+c7c02164
  • xsom Rocky Linux 8 0-19.20110809svn.module+el8.10.0+2052+1b0fb438
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.10.0+1763+c7c02164
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.10.0+2052+1b0fb438
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.6.0+843+5a13dac3
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+74+855e3f5d
  • slf4j Rocky Linux 8 1.7.25-4.module+el8.10.0+2003+8aeac9cb
  • stax-ex Rocky Linux 8 1.7.7-8.module+el8.10.0+1763+c7c02164

rocky linux advisories RLSA-2026:90909

Is CVE-2026-68498 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-68498 updated cvss 7.5

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names

  • Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9 Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9, +2 more
    affected: workaround, no fix available
  • Red Hat AI Inference Server rhaii/vllm-gaudi-rhel9, rhaiis/vllm-cuda-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat AMQ Broker 7 jackson-core Red Hat Ansible Automation Platform 2 python3.12-drools-jpy-jar, ansible-automation-platform-27/de-minimal-rhel9, ansible-automation-platform-27/de-supported-rhel9 Red Hat build of Apache Camel - HawtIO 4 jackson-core Red Hat build of Apache Camel for Spring Boot 4 jackson-core Red Hat build of Apicurio Registry 3 jackson-core Red Hat Build of Keycloak jackson-core, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
    +2 more products
    Red Hat Data Grid 8 jackson-core Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-gaudi-rhel9
    affected: workaround, no fix available
  • Red Hat JBoss Enterprise Application Platform 7 jackson-core
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Web Server 7 jboss-webserver-7/jws70-openjdk17-openshift-rhel9, jboss-webserver-7/jws70-openjdk21-openshift-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-trustyai-service-rhel9, rhai-early-access/docling-serve-cuda-rhel9 Red Hat OpenShift Dev Spaces devspaces/server-rhel9, devspaces/openvsx-rhel9, devspaces/pluginregistry-rhel9, devspaces/multicluster-redirector-rhel9 Red Hat Single Sign-On 7 jackson-core
    affected: workaround, no fix available
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-rhel8 1792044326
    fixed: vendor fix RHSA-2026:88152
  • Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-rhel8 1792044327
    fixed: vendor fix RHSA-2026:88149
  • Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-rhel8 1792044382
    fixed: vendor fix RHSA-2026:88151
show 12 more
  • Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-rhel8 1792044386
    fixed: vendor fix RHSA-2026:88150
  • Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-rhel9 1792040287
    fixed: vendor fix RHSA-2026:88156
  • Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-rhel9 1792040131
    fixed: vendor fix RHSA-2026:88159
  • Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-rhel9 1792041514
    fixed: vendor fix RHSA-2026:88153
  • Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-rhel9 1792040733
    fixed: vendor fix RHSA-2026:88158
  • Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-rhel9 1792040081
    fixed: vendor fix RHSA-2026:88157
  • Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-rhel9 1792040096
    fixed: vendor fix RHSA-2026:88155
  • Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-rhel9 1792040428
    fixed: vendor fix RHSA-2026:88154
  • Red Hat Enterprise Linux AppStream (v. 8) slf4j 1.7.25-4.module+el8.10.0+20993+d0f024b0, stax-ex 1.7.7-8.module+el8.10.0+20993+d0f024b0, velocity 1.7-24.module+el8.10.0+20993+d0f024b0, bea-stax 1.2.0-16.module+el8.10.0+20993+d0f024b0, xalan-j2 2.7.1-38.module+el8.10.0+20993+d0f024b0, javassist 3.18.1-8.module+el8.10.0+20993+d0f024b0, +27 more
    fixed: vendor fix RHSA-2026:90909
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-neethi 3.2.4-1.redhat_00001.1.el8eap, eap8-apache-sshd 2.20.0-1.redhat_00002.1.el8eap, eap8-wildfly 8.1.9.1-1.GA_redhat_00006.1.el8eap, eap8-bouncycastle 1.86.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-pg 1.86.0-1.redhat_00001.1.el8eap, eap8-ironjacamar 3.1.1-1.Final_redhat_00001.1.el8eap, +33 more Red Hat JBoss EAP 8.1 for RHEL 9 eap8-neethi 3.2.4-1.redhat_00001.1.el9eap, eap8-apache-sshd 2.20.0-1.redhat_00002.1.el9eap, eap8-wildfly 8.1.9.1-1.GA_redhat_00006.1.el9eap, eap8-bouncycastle 1.86.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-pg 1.86.0-1.redhat_00001.1.el9eap, eap8-ironjacamar 3.1.1-1.Final_redhat_00001.1.el9eap, +33 more Red Hat JBoss EAP 8.1 for RHEL 10 eap8-neethi 3.2.4-1.redhat_00001.1.el10eap, eap8-apache-sshd 2.20.0-1.redhat_00002.1.el10eap, eap8-wildfly 8.1.9.1-1.GA_redhat_00006.1.el10eap, eap8-bouncycastle 1.86.0-1.redhat_00001.1.el10eap, eap8-bouncycastle-pg 1.86.0-1.redhat_00001.1.el10eap, eap8-ironjacamar 3.1.1-1.Final_redhat_00001.1.el10eap, +32 more
    fixed: vendor fix RHSA-2026:99018
  • Red Hat JBoss Enterprise Application Platform 8.1
    fixed: vendor fix RHSA-2026:99017
  • Red Hat OpenShift Developer Tools and Services jenkins, jenkins-2-plugins Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-agent-base-rhel8 1792044376 Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-agent-base-rhel8 1792044361 Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-agent-base-rhel8 1792044402 Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-agent-base-rhel8 1792044379 Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-agent-base-rhel9 1792040156
    +2 more products
    Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-agent-base-rhel9 1792040149 Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-agent-base-rhel9 1792041201
    not affected: vulnerable code not present

25 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
22d ago

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • FasterXML jackson-core

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of FasterXML/jackson-core published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.