Skip to content
Threat Feed
Subscribe

Product

Jackson-Core (3.0.0 - 3.1.6)

1 brief RSS
low advisory

Unbounded StringBuilder Growth in jackson-core via DataInput

The jackson-core library suffers from a denial-of-service vulnerability (CVE-2026-89425) where malformed tokens in DataInput-backed parsers cause unbounded memory consumption, leading to potential JVM process crashes.

jackson-core +4 denial-of-service vulnerability java
1t 1c