CVE-2026-68498Published
jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-68498 · Microsoft / collected KEV context
cve-program · CVE-2026-68498
- https://github.com/FasterXML/jackson-core/security/advisories/GHSA-649p-m576-vr99
- https://github.com/FasterXML/jackson-core/pull/1643
- https://github.com/FasterXML/jackson-core/commit/2cd206de1163e3fcff7bdaca425274f00668b075
- https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x
- https://github.com/FasterXML/jackson-core/blob/3.x/release-notes/VERSION
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.