{"id":"CVE-2026-68498","title":"com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON propert…","summary":"A flaw was found in jackson-core. When parsing JSON data from character-based inputs, the parser does not enforce configured property name length limits while reading object keys into memory. A remote, unauthenticated attacker can exploit …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-770","CWE-400"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["exploit_intelligence","openshift_serverless","ai_inference_server","amq_broker 7","ansible_automation_platform 2","build_of_apache_camel_hawtio 4","build_of_apache_camel_for_spring_boot 4","build_of_apicurio_registry 3","build_of_keycloak","data_grid 8","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","fuse 7","jboss_enterprise_application_platform 7","jboss_enterprise_application_platform 8","jboss_web_server 7","offline_knowledge_portal","openshift_ai_rhoai","openshift_dev_spaces","single_sign_on 7","openshift_developer_tools_and_services 4.12","openshift_developer_tools_and_services 4.13","openshift_developer_tools_and_services 4.14","openshift_developer_tools_and_services 4.15","openshift_developer_tools_and_services 4.16","openshift_developer_tools_and_services 4.17","openshift_developer_tools_and_services 4.18","openshift_developer_tools_and_services 4.19","openshift_developer_tools_and_services 4.20","openshift_developer_tools_and_services 4.21","openshift_developer_tools_and_services 4.22"],"patched":["openshift_developer_tools_and_services 4.12","openshift_developer_tools_and_services 4.13","openshift_developer_tools_and_services 4.14","openshift_developer_tools_and_services 4.15","openshift_developer_tools_and_services 4.16","openshift_developer_tools_and_services 4.17","openshift_developer_tools_and_services 4.18","openshift_developer_tools_and_services 4.19","openshift_developer_tools_and_services 4.20","openshift_developer_tools_and_services 4.21","openshift_developer_tools_and_services 4.22"],"published":"2026-10-16","updated":"2026-10-23","sourceUpdated":"2026-10-23T17:23:20+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-68498"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554486"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68498"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68498"},{"url":"https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x"},{"url":"https://github.com/FasterXML/jackson-core/blob/3.x/release-notes/VERSION"},{"url":"https://github.com/FasterXML/jackson-core/commit/2cd206de1163e3fcff7bdaca425274f00668b075"},{"url":"https://github.com/FasterXML/jackson-core/pull/1643"},{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-649p-m576-vr99"},{"url":"https://access.redhat.com/errata/RHSA-2026:88152"},{"url":"https://access.redhat.com/errata/RHSA-2026:88149"},{"url":"https://access.redhat.com/errata/RHSA-2026:88151"},{"url":"https://access.redhat.com/errata/RHSA-2026:88150"},{"url":"https://access.redhat.com/errata/RHSA-2026:88156"},{"url":"https://access.redhat.com/errata/RHSA-2026:88159"},{"url":"https://access.redhat.com/errata/RHSA-2026:88153"},{"url":"https://access.redhat.com/errata/RHSA-2026:88158"},{"url":"https://access.redhat.com/errata/RHSA-2026:88157"},{"url":"https://access.redhat.com/errata/RHSA-2026:88155"},{"url":"https://access.redhat.com/errata/RHSA-2026:88154"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00652,"epssPercentile":0.51023,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-20T17:31:30.585739Z"},"ingestedAt":"2026-10-16T21:53:23.699Z","slug":"CVE-2026-68498","body":"## Overview\n\nA flaw was found in jackson-core. When parsing JSON data from character-based inputs, the parser does not enforce configured property name length limits while reading object keys into memory. A remote, unauthenticated attacker can exploit this flaw by submitting a crafted JSON payload containing an excessively long property name. Processing such input can exhaust system memory, causing the application to crash and resulting in a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **RHSA-2026:88152** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.12 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88152)\n- **RHSA-2026:88149** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.13 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88149)\n- **RHSA-2026:88151** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.14 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88151)\n- **RHSA-2026:88150** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.15 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88150)\n- **RHSA-2026:88156** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.16 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88156)\n- **RHSA-2026:88159** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.17 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88159)\n- **RHSA-2026:88153** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.18 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88153)\n- **RHSA-2026:88158** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.19 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88158)\n- **RHSA-2026:88157** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.20 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88157)\n- **RHSA-2026:88155** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.21 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88155)\n- **RHSA-2026:88154** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.22 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88154)\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, OpenShift Serverless, Red Hat AI Inference Server, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel - HawtIO 4, … · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Exploit Intelligence, OpenShift Serverless, Red Hat AI Inference Server, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json)\n\n**com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names** — rated Important by Red Hat. Released 2026-10-16, updated 2026-10-23.\n\nAffected:\n\n- Exploit Intelligence\n- OpenShift Serverless\n- Red Hat AI Inference Server\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Apicurio Registry 3\n- Red Hat Build of Keycloak\n- Red Hat Data Grid 8\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat Fuse 7\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat JBoss Enterprise Application Platform 8\n- Red Hat JBoss Web Server 7\n- Red Hat Offline Knowledge Portal\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Dev Spaces\n- Red Hat Single Sign-On 7\n\nFixed:\n\n- OpenShift Developer Tools and Services 4.12\n- OpenShift Developer Tools and Services 4.13\n- OpenShift Developer Tools and Services 4.14\n- OpenShift Developer Tools and Services 4.15\n- OpenShift Developer Tools and Services 4.16\n- OpenShift Developer Tools and Services 4.17\n- OpenShift Developer Tools and Services 4.18\n- OpenShift Developer Tools and Services 4.19\n- OpenShift Developer Tools and Services 4.20\n- OpenShift Developer Tools and Services 4.21\n- OpenShift Developer Tools and Services 4.22\n\nNo fix planned:\n\n- Red Hat JBoss Enterprise Application Platform 7\n- Exploit Intelligence\n- OpenShift Serverless\n- Red Hat AI Inference Server\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Apicurio Registry 3\n- Red Hat Build of Keycloak\n- Red Hat Data Grid 8\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat Fuse 7\n- Red Hat JBoss Enterprise Application Platform 8\n- Red Hat JBoss Web Server 7\n- Red Hat Offline Knowledge Portal\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Dev Spaces\n- Red Hat Single Sign-On 7\n\nNot affected:\n\n- OpenShift Developer Tools and Services 4.12\n- OpenShift Developer Tools and Services 4.13\n- OpenShift Developer Tools and Services 4.14\n- OpenShift Developer Tools and Services 4.15\n- OpenShift Developer Tools and Services 4.16\n- OpenShift Developer Tools and Services 4.17\n- OpenShift Developer Tools and Services 4.18\n- OpenShift Developer Tools and Services 4.19\n- OpenShift Developer Tools and Services 4.20\n- OpenShift Developer Tools and Services 4.21\n\n## Remediation\n\nIt is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-12 upgrade to the latest. https://access.redhat.com/errata/RHSA-2026:88152\nIt is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-13 upgrade to the latest. https://access.redhat.com/errata/RHSA-2026:88149\nIt is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-14 upgrade to the latest. https://access.redhat.com/errata/RHSA-2026:88151\n\nWorkarounds / mitigations:\n\n- Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was gene…","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}