CVE-2026-29062
Fixed in a distro release EPSS <1%CVSS 8.7
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.
Products: FasterXML jackson-core, Red Hat Certificate System 10, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | tools.jackson.core:jackson-core | 3.1.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-nifi | 2.8.0-r1 |
| Chainguard | apicurio-registry | 3.3.0-r1 |
| Chainguard | camunda-8.9 | 8.9.0-r1 |
| Chainguard | camunda-zeebe-8.9 | 8.9.0-r1 |
| Chainguard | flyway | 12.1.0-r0 |
| Chainguard | flyway-fips | 12.1.0-r0 |
| Chainguard | keycloak-config-cli | 6.5.1-r1 |
| Chainguard | keycloak-config-cli-iamguarded-compat | 6.5.1-r1 |
| Chainguard | sonarqube | 26.2.0.119303-r1 |
| Ubuntu 16.04 LTS | jackson-core | no fix |
| Ubuntu 18.04 LTS | jackson-core | no fix |
| Ubuntu 20.04 LTS | jackson-core | no fix |
| Ubuntu 22.04 LTS | jackson-core | no fix |
| Ubuntu 24.04 LTS | jackson-core | no fix |
| Ubuntu 25.10 | jackson-core | no fix |
| Ubuntu 26.04 LTS | jackson-core | no fix |
| Ubuntu 26.10 | jackson-core | no fix |
| Wolfi | apache-nifi | 2.8.0-r1 |
| Wolfi | apicurio-registry | 3.3.0-r1 |
| Wolfi | flyway | 12.1.0-r0 |
| Wolfi | keycloak-config-cli | 6.5.1-r1 |
| Wolfi | keycloak-config-cli-iamguarded-compat | 6.5.1-r1 |
| Wolfi | sonarqube | 26.2.0.119303-r1 |