Jackson Core 2.14.x Release Notes

Security Fixes

This release patches the following:

• CVE-2026-68494 (GHSA-r7wm-3cxj-wff9): Number Length Constraint Bypass in Async Parser via chunked digit accumulation
  • Incomplete-fix follow-up to CVE-2026-18401. The async parser enforced the maximum numeric length only when a value completed, so digit-only input streamed in small chunks with no terminator grew the text buffer far past the configured limit.
  • The limit is now enforced during streaming, at each chunk boundary.

Dependency Upgrades

• Jackson BOM (NES) 2.14.3-jackson-bom-2.14.6

Notes

• This release originates from the open‑source jackson-core project forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.

Security Fixes

This release patches the following:

• CVE-2025-52999: Nested data handling flaw in Jackson Core
  • The default maximum nesting level is 1000 to prevent potential denial-of-service attacks.
  • JsonFactory builder has streamReadConstraints for configuring the max nesting level.
  • Possible Breaking Change: Applications that rely on specific nested data structures >=1000 will need to increase the maximum allowed nesting level.
• CVE-2026-18401 (GHSA-72hv-8253-57qq): Number Length Constraint Bypass in Async Parser
  • The default maximum length of a numeric value is 1000 to prevent potential denial-of-service attacks.
  • JsonFactory builder has streamReadConstraints for configuring the max number length.
  • Possible Breaking Change: Applications that rely on number lengths >=1000 will need to increase the maximum allowed length.

Dependency Updates

• Jackson BOM (NES) 2.14.3-jackson-bom-2.14.4