Hi,

The following vulnerability was published for jackson-core.

CVE-2026-89425[0]:
| UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-
| core builds the offending-token text for its error message by
| appending Java identifier characters to a StringBuilder in a loop
| that has no upper bound. Unlike the three sibling parser
| implementations, including UTF8StreamJsonParser, it never consults
| ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A
| malformed token supplied to a parser created through
| JsonFactory.createParser(DataInput) is therefore accumulated in
| full. No StreamReadConstraints setting mitigates this:
| maxDocumentLength cannot be applied to DataInput sources at all, and
| maxStringLength does not cover this path because the accumulation
| bypasses ReadConstrainedTextBuffer. The reporter measured a
| 20,000,109-character exception message from a 20-million-character
| malformed token on the DataInput path, against 367 characters for
| identical input on the InputStream path. Scaling the payload drives
| the StringBuilder, which also incurs byte-to-char expansion and
| internal array doubling, to many times the raw payload size and can
| trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser
| was introduced in 2.8.0 together with createParser(DataInput);
| releases before 2.8.0 do not contain the affected class.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-89425
https://www.cve.org/CVERecord?id=CVE-2026-89425
[1] https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf
[2] https://github.com/FasterXML/jackson-core/pull/1698

Regards,
Salvatore

Hi,

I reassigned #1135411 to jackson-core: it comes from CVE-2025-52999.patch
(https://security-tracker.debian.org/tracker/CVE-2025-52999), which
backports the 2.15 number parsing but not the inLongRange() check from
https://github.com/FasterXML/jackson-core/pull/865. Since then every
integer with 19 digits, Long.MIN_VALUE and Long.MAX_VALUE included, fails
with "Numeric value (...) out of range of long". The build skips the
tests, so nobody noticed.

While fixing it I found that the same backport has two more gaps:

- Limits set on a JsonFactory are ignored; the parsers always use the
  defaults.
- The async parser does not enforce maxNumberLength. That is
  CVE-2026-18401 and its follow-up CVE-2026-68494
  (https://security-tracker.debian.org/tracker/CVE-2026-18401,
https://security-tracker.debian.org/tracker/CVE-2026-68494). The
  tracker marks jackson-core not affected because upstream 2.14.1 has no
  number length limit, but Debian's 2.14.1-2 does, from the
  CVE-2025-52999 backport, and its async parser accepts over-long
  numbers. I checked that in unstable.

And #1148826 (CVE-2026-89425,
https://security-tracker.debian.org/tracker/CVE-2026-89425) affects
2.14.1 as well: the DataInput parser reads the whole invalid token into
the error message, so a large one runs out of memory.

One merge request fixes all of it, each as its own patch backported from
upstream: https://salsa.debian.org/java-team/jackson-core/-/merge_requests/8
With it and the jackson-databind fix for #1139511, jackson-modules-java8
builds again and its tests pass.

trixie (2.14.1-2~deb13u1) and bookworm (2.14.1-2~deb12u1) carry the same
patch, so they should have the same problems at run time (I tested
unstable only). Copying the security team for that.

Thanks,
Juan

We believe that the bug you reported is fixed in the latest version of
jackson-core, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148826@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated jackson-core package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 15 Oct 2026 11:37:01 +0200
Source: jackson-core
Architecture: source
Version: 2.18.11-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 1135411 1148826
Changes:
 jackson-core (2.18.11-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release
     - Fixes CVE-2026-89425: the DataInput parser now caps the length of
       the token quoted in error messages (Closes: #1148826)
     - 19-digit integers are no longer rejected as out of range of long
       (Closes: #1135411)
     - Removed the patches, no longer needed
     - New build dependency on libfastdoubleparser-java
     - New build dependency on libassertj-core-java
     - Depend on junit5 instead of junit4
     - Updated the parent POMs installed with the package
     - Updated the Maven rules
   * Excluded the Maven wrapper from the source tarball
   * Enabled the test suite
   * Removed the Priority field
   * Removed the Rules-Requires-Root field
   * Converted debian/watch to the version 5 format
Checksums-Sha1:
 61590875839e59a6f674ae1bad2955a385c25c3a 2318 jackson-core_2.18.11-1.dsc
 2b8940a61bc87051ef7f37a59bfbeed04b2d2c30 752152 jackson-core_2.18.11.orig.tar.xz
 74bc3c03ea0775f41ea92b03cbfddd43fbadcef4 14620 jackson-core_2.18.11-1.debian.tar.xz
 f1836d8411ed2dd72183a482d0a4762f1c290aa4 15089 jackson-core_2.18.11-1_source.buildinfo
Checksums-Sha256:
 49e6e337081afd61f221da9087db28697583d18c6666fb12585e48157501cc78 2318 jackson-core_2.18.11-1.dsc
 3f60b8afd8c0924383d408e82561c4fa0ee24df8b7566a8399396afd74f743e2 752152 jackson-core_2.18.11.orig.tar.xz
 cc15f72d3737e764ee25f83b90fdbf7defb3254582040534e3ab9a71308ab5eb 14620 jackson-core_2.18.11-1.debian.tar.xz
 efde5b6a2cd4c27939262a612f13002503dc25c35648b2e4910d64fb42b61dde 15089 jackson-core_2.18.11-1_source.buildinfo
Files:
 d8752ebc683984e97dee3c885744b927 2318 java optional jackson-core_2.18.11-1.dsc
 7d526d76391c142bd5a7ebf332fe5b05 752152 java optional jackson-core_2.18.11.orig.tar.xz
 0974a7cc00a531134e2e631ff787b74d 14620 java optional jackson-core_2.18.11-1.debian.tar.xz
 9cdcc8edaf69d6c27ca5b9249e8b7c35 15089 java optional jackson-core_2.18.11-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrQyOESHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsKooP/jQi6greUNRx95Wn0jIdBQF8it1OnpGb
lHeu2LlIWLjg5YaZIQWJ4rVSdcALu/NMTkq4xV3C8S2OUEr8xjT8npLENcY25/Nd
lsCkVk44YxfdOldgDzbLOfUCOVQdHyhKpRppCdVLKnv+09XsTX12l0viA5OOxNi0
klKApWrM7F5s8P5YE9un9HoKfIgqA1CM2/XdSR1CvLKdDh/0fdbSg4uXYbIt4QxW
CajMbulykJpMXyw2Op4KzW99gVT3X6GL0YqTKRSlxQptJAr4X4nyLARlPMK5KrLv
8Dj/Oh+8Fiv+fxeBUUCyqFTR152Aduz26r6dajhJR2/swki99sR+Pw5YmxBXAlEf
7/AxUdc4AGfY7Hd8294zht6o6euc0aFu7cbHa1U373x1/oTDaLjyRyESM0x9f+WD
yaGtFb4FYw5WdxzkDInNA1r33NZp/c050k9hJwwNt57cSg67g0oW0ITXSO6PfRhh
efn8oEbkneIjhtiX/paXMn5g8vuEMIjDXeCoLqg+GacMp1b1UMYNG3XpktE5ZMc3
AkorqwFVgBkLbtHnEeUW+OyVIgJ3o5wquAex+xm7D0fOlPmzKzvvZlGxZpLOWkB0
Q0HJtwGDfd2PoW4yQj7ss1iB4XltJNIlq8TZCuqVeaAa900eKr4eRPoYjjAwXEQN
7p1xGZSQEUx8
=XctJ
-----END PGP SIGNATURE-----