jackson-core -- StreamReadConstraints can be bypassed

2026-08-23 · CVE-2026-68498 · VuXML entry

The Jackson project reports: Enforce maxNameLength incrementally in ReaderBasedJsonParser Fail parsing from DataInput if StreamReadConstraints.getMaxDocumentLength() set Fix maxDocumentLength bypass in async parser single feedInput() case Enforce StreamReadConstraints.maxNumberLength for non-blocking (async) parser UTF8DataInputJsonParser needs to enforce StreamReadConstraints.maxNameLength limit

Affected versions

• jackson-core < 2.22.2

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.