{ "cveId": "CVE-2026-19032", "url": "https://patchblox.com/security/cve/CVE-2026-19032", "summary": "CVE-2026-19032 is fixed in 5 products on 1 platform, first by DEBIAN-CVE-2026-19032, released September 1, 2026. It is not reported as exploited. Patch Radar priority: Routine.", "title": "jackson-annotations: This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dat...", "description": "This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues:\n\n- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues\n (bsc#1273856).\n- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).\n- CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).\n- CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).\n- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).\n- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).\n- CVE-2026-89425: \u0060UTF8DataInputJsonParser._reportInvalidToken()\u0060lacks \u0060maxErrorTokenLength\u0060 limit, which allows for\n unbounded \u0060StringBuilder\u0060 growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.11\n\nChanges for jackson-bom:\n\n- Update to 2.18.11\n\nChanges for jackson-core:\n \n- Update to 2.18.11\n * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,\n CVE-2026-89407)\n * #1698: UTF8DataInputJsonParser does not honor\n maxErrorTokenLength when reporting an unrecognized token\n (bsc#1282505, CVE-2026-89425)\n * #1642: Fix maxDocumentLength bypass in async parser\n single-feedInput() case [GHSA-2c4j-63jj-9fqr]\n * #1643: Enforce maxNameLength incrementally in\n ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)\n of async parser (bsc#1273857, CVE-2026-68494)\n non-blocking (async) parser (bsc#1273856, CVE-2026-18401)\n\nChanges for jackson-databind:\n\n- Update to 2.18.11\n * #6185: Bracket unresolved IPv6 host name in InetSocketAddress\n serialization\n * #6203: Prevent unbounded growth of type id cache in\n TypeDeserializer (bsc#1282491, CVE-2026-91776)\n * #6204: Avoid quadratic forward-reference resolution in\n Collection/Map deserializers (bsc#1282492, CVE-2026-91777)\n * #6099: Resolve classes without initialization in\n TypeFactory.findClass()\n * #6116: Reject non-ASCII digits in InetAddress literal validation\n * #6127: Add StreamReadConstraints number len constraint to\n javax.xml.datatype.XMLGregorianCalendar and\n javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)\n * #6129: Limit the supported URL schemes for java.nio.file.Path\n deserialization (bsc#1277883, CVE-2026-19032)\n * #6156: Add java.lang.Comparable in set of unsafe polymorphic\n base types (bsc#1278008, CVE-2026-83557)\n * #6165: Apply number length limits to BigDecimal/BigInteger/\n /Double/Float Map keys\n\nChanges for jackson-dataformat-xml:\n\n- Update to 2.18.11\n * Fix build to avoid past-JDK-8 bytecode generation\n * #891: Enforce StreamReadConstraints.maxNestingDepth in\n FromXmlParser\n\nChanges for jackson-dataformats-binary:\n\n- Update to 2.18.11\n * #783: (protobuf) Support StreamReadConstraints.maxDocumentLength\n in ProtobufParser\n * #785: (avro) Support StreamReadConstraints.maxDocumentLength and\n maxTokenCount in Avro parser\n * #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion\n parser (partial fix for #358)\n * #805: (ion) Support StreamReadConstraints.maxDocumentLength in\n Ion parser (partial fix for #358)\n * #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser\n (bsc#1282639, CVE-2026-68495)\n * #726: (smile) Ensure maxNameLength limit enforced for Smile\n parser (bsc#1282640, CVE-2026-68496)\n * #727: (cbor) CBORParser.nextFieldName(SerializableString)\n confuses 5-bit length marker 23 with 24 (\u00271-byte length suffix\n follows\u0027)\n * #728: (cbor) CBORParser.nextFieldName(SerializableString)\n consumes Object entry slot twice on fast-path miss, truncating\n definite-length Objects\n * #733: (cbor) Long \u0060String\u0060s not added to \u0027stringref\u0027 reference\n table, breaking following references\n * #735: (cbor) \u0027stringref\u0027 property-name paths pass 5-bit length\n marker instead of actual length to shouldReferenceString()\n * #736: (cbor) Long Object property names added to \u0027stringref\u0027\n reference table twice\n\nChanges for jackson-modules-base:\n\n- Update to 2.18.11", "published": "2026-09-01T04:18:00Z", "severity": "medium", "cvss": 5.3, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "epss": 0.00572, "epssPercentile": 0.4756, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "jackson-annotations", "release": "opensuse-leap 16.0", "fixedVersion": "2.18.11-160000.1.1", "fix": "OPENSUSE-SU-2026:22034-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22034-1", "released": "2026-10-06T14:10:27Z" }, { "platform": "linux", "product": "jackson-annotations", "release": "sles 15.6", "fixedVersion": "2.18.11-150200.3.28.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-annotations", "release": "sles 15.7", "fixedVersion": "2.18.11-150200.3.28.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-annotations", "release": "sles 16.0", "fixedVersion": "2.18.11-160000.1.1", "fix": "SUSE-SU-2026:24149-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24149-1", "released": "2026-10-06T14:12:21Z" }, { "platform": "linux", "product": "jackson-core", "release": "opensuse-leap 16.0", "fixedVersion": "2.18.11-160000.1.1", "fix": "OPENSUSE-SU-2026:22034-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22034-1", "released": "2026-10-06T14:10:27Z" }, { "platform": "linux", "product": "jackson-core", "release": "sles 15.6", "fixedVersion": "2.18.11-150200.3.30.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-core", "release": "sles 15.7", "fixedVersion": "2.18.11-150200.3.30.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-core", "release": "sles 16.0", "fixedVersion": "2.18.11-160000.1.1", "fix": "SUSE-SU-2026:24149-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24149-1", "released": "2026-10-06T14:12:21Z" }, { "platform": "linux", "product": "jackson-databind", "release": "Debian 14", "fixedVersion": "2.18.11-1", "fix": "DEBIAN-CVE-2026-19032", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-19032", "released": "2026-09-01T04:18:00Z" }, { "platform": "linux", "product": "jackson-databind", "release": "amzn 2023", "fixedVersion": "2.21.7-1.amzn2023.0.1", "fix": "ALAS2023-2026-3305", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3305", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "jackson-databind", "release": "opensuse-leap 16.0", "fixedVersion": "2.18.11-160000.1.1", "fix": "OPENSUSE-SU-2026:22034-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22034-1", "released": "2026-10-06T14:10:27Z" }, { "platform": "linux", "product": "jackson-databind", "release": "sles 15.6", "fixedVersion": "2.18.11-150200.3.36.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-databind", "release": "sles 15.7", "fixedVersion": "2.18.11-150200.3.36.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-databind", "release": "sles 16.0", "fixedVersion": "2.18.11-160000.1.1", "fix": "SUSE-SU-2026:24149-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24149-1", "released": "2026-10-06T14:12:21Z" }, { "platform": "linux", "product": "jackson-dataformat-xml", "release": "sles 15.6", "fixedVersion": "2.18.11-150200.5.8.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-dataformat-xml", "release": "sles 15.7", "fixedVersion": "2.18.11-150200.5.8.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-dataformats-binary", "release": "sles 15.6", "fixedVersion": "2.18.11-150200.3.29.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-dataformats-binary", "release": "sles 15.7", "fixedVersion": "2.18.11-150200.3.29.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T19:12:23Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }