CVE-2026-68498Published
jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-68498 · Microsoft / collected KEV context
cve-program · CVE-2026-68498
- https://github.com/FasterXML/jackson-core/security/advisories/GHSA-649p-m576-vr99
- https://github.com/FasterXML/jackson-core/pull/1643
- https://github.com/FasterXML/jackson-core/commit/2cd206de1163e3fcff7bdaca425274f00668b075
- https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x
- https://github.com/FasterXML/jackson-core/blob/3.x/release-notes/VERSION
Related operational evidence
Explicit CVE identifiers- Crowd Data Center: DoS (Denial of Service) tools.jackson.core:jackson-core Dependency (CVE-2026-68498) · Security advisory · 20 Oct 2026