---
id: CVE-2026-68498
title: >-
  com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core:
  jackson-core: Denial of Service via excessively long JSON propert…
summary: >-
  A flaw was found in jackson-core. When parsing JSON data from character-based
  inputs, the parser does not enforce configured property name length limits
  while reading object keys into memory. A remote, unauthenticated attacker can
  exploit …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-770
  - CWE-400
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - exploit_intelligence
  - openshift_serverless
  - ai_inference_server
  - amq_broker 7
  - ansible_automation_platform 2
  - build_of_apache_camel_hawtio 4
  - build_of_apache_camel_for_spring_boot 4
  - build_of_apicurio_registry 3
  - build_of_keycloak
  - data_grid 8
  - enterprise_linux 8
  - enterprise_linux 9
  - enterprise_linux_ai_rhel_ai 3
  - fuse 7
  - jboss_enterprise_application_platform 7
  - jboss_enterprise_application_platform 8
  - jboss_web_server 7
  - offline_knowledge_portal
  - openshift_ai_rhoai
  - openshift_dev_spaces
  - single_sign_on 7
  - openshift_developer_tools_and_services 4.12
  - openshift_developer_tools_and_services 4.13
  - openshift_developer_tools_and_services 4.14
  - openshift_developer_tools_and_services 4.15
  - openshift_developer_tools_and_services 4.16
  - openshift_developer_tools_and_services 4.17
  - openshift_developer_tools_and_services 4.18
  - openshift_developer_tools_and_services 4.19
  - openshift_developer_tools_and_services 4.20
  - openshift_developer_tools_and_services 4.21
  - openshift_developer_tools_and_services 4.22
patched:
  - openshift_developer_tools_and_services 4.12
  - openshift_developer_tools_and_services 4.13
  - openshift_developer_tools_and_services 4.14
  - openshift_developer_tools_and_services 4.15
  - openshift_developer_tools_and_services 4.16
  - openshift_developer_tools_and_services 4.17
  - openshift_developer_tools_and_services 4.18
  - openshift_developer_tools_and_services 4.19
  - openshift_developer_tools_and_services 4.20
  - openshift_developer_tools_and_services 4.21
  - openshift_developer_tools_and_services 4.22
published: '2026-10-16'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T17:23:20+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-68498'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2554486'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-68498'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68498'
  - url: >-
      https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x
  - url: 'https://github.com/FasterXML/jackson-core/blob/3.x/release-notes/VERSION'
  - url: >-
      https://github.com/FasterXML/jackson-core/commit/2cd206de1163e3fcff7bdaca425274f00668b075
  - url: 'https://github.com/FasterXML/jackson-core/pull/1643'
  - url: >-
      https://github.com/FasterXML/jackson-core/security/advisories/GHSA-649p-m576-vr99
  - url: 'https://access.redhat.com/errata/RHSA-2026:88152'
  - url: 'https://access.redhat.com/errata/RHSA-2026:88149'
  - url: 'https://access.redhat.com/errata/RHSA-2026:88151'
  - url: 'https://access.redhat.com/errata/RHSA-2026:88150'
  - url: 'https://access.redhat.com/errata/RHSA-2026:88156'
  - url: 'https://access.redhat.com/errata/RHSA-2026:88159'
  - url: 'https://access.redhat.com/errata/RHSA-2026:88153'
  - url: 'https://access.redhat.com/errata/RHSA-2026:88158'
  - url: 'https://access.redhat.com/errata/RHSA-2026:88157'
  - url: 'https://access.redhat.com/errata/RHSA-2026:88155'
  - url: 'https://access.redhat.com/errata/RHSA-2026:88154'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00652
epssPercentile: 0.51023
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-20T17:31:30.585739Z'
ingestedAt: '2026-10-16T21:53:23.699Z'
---

## Overview

A flaw was found in jackson-core. When parsing JSON data from character-based inputs, the parser does not enforce configured property name length limits while reading object keys into memory. A remote, unauthenticated attacker can exploit this flaw by submitting a crafted JSON payload containing an excessively long property name. Processing such input can exhaust system memory, causing the application to crash and resulting in a Denial of Service (DoS).

## Vendor advisories

- **RHSA-2026:88152** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.12 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88152)
- **RHSA-2026:88149** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.13 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88149)
- **RHSA-2026:88151** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.14 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88151)
- **RHSA-2026:88150** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.15 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88150)
- **RHSA-2026:88156** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.16 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88156)
- **RHSA-2026:88159** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.17 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88159)
- **RHSA-2026:88153** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.18 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88153)
- **RHSA-2026:88158** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.19 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88158)
- **RHSA-2026:88157** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.20 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88157)
- **RHSA-2026:88155** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.21 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88155)
- **RHSA-2026:88154** · Red Hat · fixed in: OpenShift Developer Tools and Services 4.22 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88154)
- **Red Hat VEX** · Important · affected: Exploit Intelligence, OpenShift Serverless, Red Hat AI Inference Server, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel - HawtIO 4, … · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Exploit Intelligence, OpenShift Serverless, Red Hat AI Inference Server, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68498.json)

**com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names** — rated Important by Red Hat. Released 2026-10-16, updated 2026-10-23.

Affected:

- Exploit Intelligence
- OpenShift Serverless
- Red Hat AI Inference Server
- Red Hat AMQ Broker 7
- Red Hat Ansible Automation Platform 2
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Web Server 7
- Red Hat Offline Knowledge Portal
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces
- Red Hat Single Sign-On 7

Fixed:

- OpenShift Developer Tools and Services 4.12
- OpenShift Developer Tools and Services 4.13
- OpenShift Developer Tools and Services 4.14
- OpenShift Developer Tools and Services 4.15
- OpenShift Developer Tools and Services 4.16
- OpenShift Developer Tools and Services 4.17
- OpenShift Developer Tools and Services 4.18
- OpenShift Developer Tools and Services 4.19
- OpenShift Developer Tools and Services 4.20
- OpenShift Developer Tools and Services 4.21
- OpenShift Developer Tools and Services 4.22

No fix planned:

- Red Hat JBoss Enterprise Application Platform 7
- Exploit Intelligence
- OpenShift Serverless
- Red Hat AI Inference Server
- Red Hat AMQ Broker 7
- Red Hat Ansible Automation Platform 2
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Web Server 7
- Red Hat Offline Knowledge Portal
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces
- Red Hat Single Sign-On 7

Not affected:

- OpenShift Developer Tools and Services 4.12
- OpenShift Developer Tools and Services 4.13
- OpenShift Developer Tools and Services 4.14
- OpenShift Developer Tools and Services 4.15
- OpenShift Developer Tools and Services 4.16
- OpenShift Developer Tools and Services 4.17
- OpenShift Developer Tools and Services 4.18
- OpenShift Developer Tools and Services 4.19
- OpenShift Developer Tools and Services 4.20
- OpenShift Developer Tools and Services 4.21

## Remediation

It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-12 upgrade to the latest. https://access.redhat.com/errata/RHSA-2026:88152
It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-13 upgrade to the latest. https://access.redhat.com/errata/RHSA-2026:88149
It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-14 upgrade to the latest. https://access.redhat.com/errata/RHSA-2026:88151

Workarounds / mitigations:

- Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.

--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was gene…