Moderate Vulnerability in jackson-core: Denial of Service Risks
Summary
RLSA-2026:86706: Moderate: jackson-core security update. Affects jackson-core versions < 0:2.21.6-1.el9_8.2. Fixed in 0:2.21.6-1.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jackson-core is a core component of the Jackson library, which provides a streaming API for processing JSON data. It is widely used in Java applications for its efficiency and ease of use. The library's functionality includes parsing and generating JSON, making it a critical part of many software systems. However, recent vulnerabilities have been identified that expose applications using this library to Denial of Service (DoS) attacks, particularly through regular expression backtracking and unbounded StringBuilder growth during malformed token processing.
Vulnerability Detail
The identified vulnerabilities in jackson-core include CVE-2026-89407 and CVE-2026-89425. CVE-2026-89407 allows attackers to exploit regular expression backtracking, potentially leading to resource exhaustion and application downtime. CVE-2026-89425 involves unbounded growth of StringBuilder during the processing of malformed tokens, which can also result in Denial of Service. Both vulnerabilities can severely impact application availability and performance, making it crucial for developers to address them promptly.
How To Fix
Minimum fixed version
0:2.21.6-1.el9_8.2
This is the first release that contains the fix.
sudo dnf update jackson-coreTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to restrict the types of JSON data your application processes. This can help prevent malformed tokens from being processed, thereby reducing the risk of triggering the vulnerabilities.
Conclusion
The vulnerabilities in jackson-core pose significant risks to applications utilizing this library. It is essential to update to the latest patched version to protect against potential Denial of Service attacks. Implementing input validation can serve as a temporary workaround while ensuring that your application remains secure.
See every vulnerability recorded for jackson-core →
FAQ
Jackson-core is a library used for processing JSON data in Java applications, providing a streaming API for efficient data handling.
The vulnerabilities can lead to Denial of Service attacks, causing application downtime and resource exhaustion.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score for these vulnerabilities is 7.5, indicating a moderate severity level.
It is recommended to regularly check for updates to your dependencies and apply security patches as soon as they are available to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for jackson-core.
