{"id":"openSUSE-SU-2026:22034-1","summary":"Security update for jackson-annotations, jackson-core, jackson-databind","details":"This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:\n\n- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues\n  (bsc#1273856).\n- CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without restricting the URI\n  scheme (bsc#1277883).\n- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).\n- CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).\n- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).\n- CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable` deserialization\n  (bsc#1278008).\n- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).\n- CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for\n  unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).\n- CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the raw, attacker-\n  supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).\n- CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan of the pending-\n  reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization\n  (bsc#1282492).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.11\n\nChanges for jackson-core:\n\n- Update to 2.18.11\n * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,\n CVE-2026-89407)\n * #1698: UTF8DataInputJsonParser does not honor\n maxErrorTokenLength when reporting an unrecognized token\n (bsc#1282505, CVE-2026-89425)\n * #1642: Fix maxDocumentLength bypass in async parser\n single-feedInput() case [GHSA-2c4j-63jj-9fqr]\n * #1643: Enforce maxNameLength incrementally in\n ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)\n of async parser (bsc#1273857, CVE-2026-68494)\n non-blocking (async) parser (bsc#1273856, CVE-2026-18401)\n\nChanges for jackson-databind:\n\n- Update to 2.18.11\n * #6185: Bracket unresolved IPv6 host name in InetSocketAddress\n serialization\n * #6203: Prevent unbounded growth of type id cache in\n TypeDeserializer (bsc#1282491, CVE-2026-91776)\n * #6204: Avoid quadratic forward-reference resolution in\n Collection/Map deserializers (bsc#1282492, CVE-2026-91777)\n * #6099: Resolve classes without initialization in\n TypeFactory.findClass()\n * #6116: Reject non-ASCII digits in InetAddress literal validation\n * #6127: Add StreamReadConstraints number len constraint to\n javax.xml.datatype.XMLGregorianCalendar and\n javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)\n * #6129: Limit the supported URL schemes for java.nio.file.Path\n deserialization (bsc#1277883, CVE-2026-19032)\n * #6156: Add java.lang.Comparable in set of unsafe polymorphic\n base types (bsc#1278008, CVE-2026-83557)\n * #6165: Apply number length limits to BigDecimal/BigInteger/\n /Double/Float Map keys\n","modified":"2026-10-09T17:23:14.417272976Z","published":"2026-10-06T14:10:27Z","related":["CVE-2026-18401","CVE-2026-19032","CVE-2026-68494","CVE-2026-68497","CVE-2026-68498","CVE-2026-83557","CVE-2026-89407","CVE-2026-89425","CVE-2026-91776","CVE-2026-91777"],"upstream":["CVE-2026-18401","CVE-2026-19032","CVE-2026-68494","CVE-2026-68497","CVE-2026-68498","CVE-2026-83557","CVE-2026-89407","CVE-2026-89425","CVE-2026-91776","CVE-2026-91777"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1273856"},{"type":"REPORT","url":"https://bugzilla.suse.com/1273857"},{"type":"REPORT","url":"https://bugzilla.suse.com/1277883"},{"type":"REPORT","url":"https://bugzilla.suse.com/1278008"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280125"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282491"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282492"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282505"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282641"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282645"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-18401"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-19032"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-68494"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-68497"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-68498"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-83557"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-89407"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-89425"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-91776"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-91777"}],"affected":[{"package":{"name":"jackson-annotations","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/jackson-annotations&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"jackson-databind-javadoc":"2.18.11-160000.1.1","jackson-annotations":"2.18.11-160000.1.1","jackson-annotations-javadoc":"2.18.11-160000.1.1","jackson-core":"2.18.11-160000.1.1","jackson-core-javadoc":"2.18.11-160000.1.1","jackson-databind":"2.18.11-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22034-1.json"}},{"package":{"name":"jackson-core","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/jackson-core&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"jackson-databind":"2.18.11-160000.1.1","jackson-databind-javadoc":"2.18.11-160000.1.1","jackson-annotations":"2.18.11-160000.1.1","jackson-annotations-javadoc":"2.18.11-160000.1.1","jackson-core":"2.18.11-160000.1.1","jackson-core-javadoc":"2.18.11-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22034-1.json"}},{"package":{"name":"jackson-databind","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/jackson-databind&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"jackson-core-javadoc":"2.18.11-160000.1.1","jackson-databind":"2.18.11-160000.1.1","jackson-databind-javadoc":"2.18.11-160000.1.1","jackson-annotations":"2.18.11-160000.1.1","jackson-annotations-javadoc":"2.18.11-160000.1.1","jackson-core":"2.18.11-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22034-1.json"}}],"schema_version":"1.9.0"}