CVE-2026-68498High· 7.5▾ TwilightA flaw was found in jackson-core. When parsing JSON data from character-based inputs, the parser does not enforce configured property name length limits while reading object keys into memory. A remote, unauthenticated attacker can exploit …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.9%
Last analysed / modified upstream
A flaw was found in jackson-core. When parsing JSON data from character-based inputs, the parser does not enforce configured property name length limits while reading object keys into memory. A remote, unauthenticated attacker can exploit this flaw by submitting a crafted JSON payload containing an excessively long property name. Processing such input can exhaust system memory, causing the application to crash and resulting in a Denial of Service (DoS).
com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names — rated Important by Red Hat. Released 2026-10-16, updated 2026-10-23.
Affected:
Fixed:
No fix planned:
Not affected:
It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-12 upgrade to the latest. https://access.redhat.com/errata/RHSA-2026:88152 It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-13 upgrade to the latest. https://access.redhat.com/errata/RHSA-2026:88149 It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-14 upgrade to the latest. https://access.redhat.com/errata/RHSA-2026:88151
Workarounds / mitigations:
--- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was gene…
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111066High· 7.5aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing (CVE-2026-111066)
CVE-2026-67318Medium· 5.3axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2
CVE-2026-56816High· 7.5io.netty:netty-codec-http3: Netty: Denial of Service due to uncontrolled memory buffering in HTTP/3 (CVE-2026-56816)
CVE-2026-116141Medium· 5.3ImageMagick: ImageMagick: Denial of Service via policy bypass in UHDR decoder (CVE-2026-116141)
CVE-2026-108106High· 7.5Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input
CVE-2026-86250High· 7.5h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions