Your message dated Thu, 15 Oct 2026 13:07:08 +0000
with message-id <[email protected]>
and subject line Bug#1148826: fixed in jackson-core 2.18.11-1
has caused the Debian Bug report #1148826,
regarding jackson-core: CVE-2026-89425
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148826: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148826
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: jackson-core
Version: 2.14.1-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: found -1 2.14.1-2~deb13u1
Hi,
The following vulnerability was published for jackson-core.
CVE-2026-89425[0]:
| UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-
| core builds the offending-token text for its error message by
| appending Java identifier characters to a StringBuilder in a loop
| that has no upper bound. Unlike the three sibling parser
| implementations, including UTF8StreamJsonParser, it never consults
| ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A
| malformed token supplied to a parser created through
| JsonFactory.createParser(DataInput) is therefore accumulated in
| full. No StreamReadConstraints setting mitigates this:
| maxDocumentLength cannot be applied to DataInput sources at all, and
| maxStringLength does not cover this path because the accumulation
| bypasses ReadConstrainedTextBuffer. The reporter measured a
| 20,000,109-character exception message from a 20-million-character
| malformed token on the DataInput path, against 367 characters for
| identical input on the InputStream path. Scaling the payload drives
| the StringBuilder, which also incurs byte-to-char expansion and
| internal array doubling, to many times the raw payload size and can
| trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser
| was introduced in 2.8.0 together with createParser(DataInput);
| releases before 2.8.0 do not contain the affected class.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-89425
https://www.cve.org/CVERecord?id=CVE-2026-89425
[1]
https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf
[2] https://github.com/FasterXML/jackson-core/pull/1698
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: jackson-core
Source-Version: 2.18.11-1
Done: Emmanuel Bourg <[email protected]>
We believe that the bug you reported is fixed in the latest version of
jackson-core, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Emmanuel Bourg <[email protected]> (supplier of updated jackson-core package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 15 Oct 2026 11:37:01 +0200
Source: jackson-core
Architecture: source
Version: 2.18.11-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers
<[email protected]>
Changed-By: Emmanuel Bourg <[email protected]>
Closes: 1135411 1148826
Changes:
jackson-core (2.18.11-1) unstable; urgency=medium
.
* Team upload.
* New upstream release
- Fixes CVE-2026-89425: the DataInput parser now caps the length of
the token quoted in error messages (Closes: #1148826)
- 19-digit integers are no longer rejected as out of range of long
(Closes: #1135411)
- Removed the patches, no longer needed
- New build dependency on libfastdoubleparser-java
- New build dependency on libassertj-core-java
- Depend on junit5 instead of junit4
- Updated the parent POMs installed with the package
- Updated the Maven rules
* Excluded the Maven wrapper from the source tarball
* Enabled the test suite
* Removed the Priority field
* Removed the Rules-Requires-Root field
* Converted debian/watch to the version 5 format
Checksums-Sha1:
61590875839e59a6f674ae1bad2955a385c25c3a 2318 jackson-core_2.18.11-1.dsc
2b8940a61bc87051ef7f37a59bfbeed04b2d2c30 752152
jackson-core_2.18.11.orig.tar.xz
74bc3c03ea0775f41ea92b03cbfddd43fbadcef4 14620
jackson-core_2.18.11-1.debian.tar.xz
f1836d8411ed2dd72183a482d0a4762f1c290aa4 15089
jackson-core_2.18.11-1_source.buildinfo
Checksums-Sha256:
49e6e337081afd61f221da9087db28697583d18c6666fb12585e48157501cc78 2318
jackson-core_2.18.11-1.dsc
3f60b8afd8c0924383d408e82561c4fa0ee24df8b7566a8399396afd74f743e2 752152
jackson-core_2.18.11.orig.tar.xz
cc15f72d3737e764ee25f83b90fdbf7defb3254582040534e3ab9a71308ab5eb 14620
jackson-core_2.18.11-1.debian.tar.xz
efde5b6a2cd4c27939262a612f13002503dc25c35648b2e4910d64fb42b61dde 15089
jackson-core_2.18.11-1_source.buildinfo
Files:
d8752ebc683984e97dee3c885744b927 2318 java optional jackson-core_2.18.11-1.dsc
7d526d76391c142bd5a7ebf332fe5b05 752152 java optional
jackson-core_2.18.11.orig.tar.xz
0974a7cc00a531134e2e631ff787b74d 14620 java optional
jackson-core_2.18.11-1.debian.tar.xz
9cdcc8edaf69d6c27ca5b9249e8b7c35 15089 java optional
jackson-core_2.18.11-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrQyOESHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsKooP/jQi6greUNRx95Wn0jIdBQF8it1OnpGb
lHeu2LlIWLjg5YaZIQWJ4rVSdcALu/NMTkq4xV3C8S2OUEr8xjT8npLENcY25/Nd
lsCkVk44YxfdOldgDzbLOfUCOVQdHyhKpRppCdVLKnv+09XsTX12l0viA5OOxNi0
klKApWrM7F5s8P5YE9un9HoKfIgqA1CM2/XdSR1CvLKdDh/0fdbSg4uXYbIt4QxW
CajMbulykJpMXyw2Op4KzW99gVT3X6GL0YqTKRSlxQptJAr4X4nyLARlPMK5KrLv
8Dj/Oh+8Fiv+fxeBUUCyqFTR152Aduz26r6dajhJR2/swki99sR+Pw5YmxBXAlEf
7/AxUdc4AGfY7Hd8294zht6o6euc0aFu7cbHa1U373x1/oTDaLjyRyESM0x9f+WD
yaGtFb4FYw5WdxzkDInNA1r33NZp/c050k9hJwwNt57cSg67g0oW0ITXSO6PfRhh
efn8oEbkneIjhtiX/paXMn5g8vuEMIjDXeCoLqg+GacMp1b1UMYNG3XpktE5ZMc3
AkorqwFVgBkLbtHnEeUW+OyVIgJ3o5wquAex+xm7D0fOlPmzKzvvZlGxZpLOWkB0
Q0HJtwGDfd2PoW4yQj7ss1iB4XltJNIlq8TZCuqVeaAa900eKr4eRPoYjjAwXEQN
7p1xGZSQEUx8
=XctJ
-----END PGP SIGNATURE-----
pgpOrlr6GB4mE.pgp
Description: PGP signature
--- End Message ---
