Visit NES for Jackson Home Page
NES for Jackson Core 2.15.x Release Notes
6 versions
Comprehensive release notes and changelog for NES for Jackson Core 2.15.x, including security patches, bug fixes, and feature updates across all supported versions.
September 2026
2.15.10
Released Sep 24, 2026 Full Version:
2.15.4-jackson-core-2.15.10
Security Fixes
This release patches the following:
- CVE-2026-89425: bound the invalid-token error message length in UTF8DataInputJsonParser for DataInput sources
Dependency Upgrades
- Jackson BOM (NES)
2.15.4-jackson-bom-2.15.10
2.15.9
Released Sep 10, 2026 Full Version:
2.15.4-jackson-core-2.15.9
Dependency Upgrades
- Jackson BOM (NES)
2.15.4-jackson-bom-2.15.9
2.15.8
Released Sep 4, 2026 Full Version:
2.15.4-jackson-core-2.15.8
Dependency Upgrades
- Jackson BOM (NES)
2.15.4-jackson-bom-2.15.8
July 2026
2.15.7
Released Jul 26, 2026 Full Version:
2.15.4-jackson-core-2.15.7
Security Fixes
This release patches the following:
- CVE-2026-68494 (GHSA-r7wm-3cxj-wff9): Number Length Constraint Bypass in Async Parser via chunked digit accumulation
- Incomplete-fix follow-up to CVE-2026-18401. The async parser enforced the maximum numeric length only when a value completed, so digit-only input streamed in small chunks with no terminator grew the text buffer far past the configured limit.
- The limit is now enforced during streaming, at each chunk boundary.
Dependency Upgrades
- Jackson BOM (NES)
2.15.4-jackson-bom-2.15.7
2.15.6
Released Jul 1, 2026 Full Version:
2.15.4-jackson-core-2.15.6
Security Fixes
This release patches the following:
- CVE-2026-18401 (GHSA-72hv-8253-57qq): Number Length Constraint Bypass in Async Parser
- The default maximum length of a numeric value is 1000 to prevent potential denial-of-service attacks.
- JsonFactory builder has streamReadConstraints for configuring the max number length.
- Possible Breaking Change: Applications that rely on number lengths >=1000 will need to increase the maximum allowed length.
Dependency Updates
- Jackson BOM (NES)
2.15.4-jackson-bom-2.15.6
2.15.5
Released Jul 1, 2026 Full Version:
2.15.4-jackson-core-2.15.5
Notes
- This release originates from the open‑source jackson-core project forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.
Dependency Updates
- Jackson BOM (NES)
2.15.4-jackson-bom-2.15.5
Stay in the loop
~/herodevs-spring-framework-support
herodevs@nes:open-source$ ./display-support-info.sh