Allocation of Resources Without Limits or Throttling in jackson-core - CVE-2026-89425

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU151853

Allocation of Resources Without Limits or Throttling in jackson-core - CVE-2026-89425

Published: September 23, 2026


Vulnerability identifier: #VU151853
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89425
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in UTF8DataInputJsonParser._reportInvalidToken() when processing malformed JSON tokens through a DataInput-backed parser. A remote attacker can supply a malformed token to cause a denial of service.


Affected software

jackson-core
Test Accelerator for Z - Early Development Testing Eclipse
BigMemory Max
IBM Maximo Scheduler Optimization
CICS Transaction Gateway Desktop Edition
Security Verify Governance Adapter for Google Workspace
Security Verify Governance Adapter for CyberArk
Terracotta
InfoSphere Data Replication
Db2 Developer Extension
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Development Tools Module
Basesystem Module
Fedora
IBM SPSS Analytic Server
IBM SPSS Collaboration and Deployment Services
IBM SPSS Modeler
IBM Business Automation Workflow
IBM Netezza Performance Server
jackson-parent
jackson-annotations
jackson-dataformat-cbor
jackson-core
jackson-databind
jackson-dataformat-xml
jackson-modules-base
jackson-jaxrs-providers
jackson-bom
jackson-core (Red Hat package)
fasterxml-oss-parent

How to mitigate CVE-2026-89425

Install security update from vendor's website.

jackson-core - addressed in versions 2.18.11, 2.21.7, 2.22.3, 3.1.7, 3.2.3
Test Accelerator for Z - Early Development Testing Eclipse - update to 3.1.0
BigMemory Max - addressed in versions 4.4.0.34, 4.4.1.22, 4.5.1.8
IBM SPSS Collaboration and Deployment Services - addressed in versions 8.4.0.0 IF009, 8.5.0.0 IF009, 8.6.0.0 IF009
IBM Maximo Scheduler Optimization - addressed in versions 9.0.28, 9.1.17, 9.2.4
Terracotta - addressed in versions 10.15.0.41, 11.1.0.23, 12.1.0.6
InfoSphere Data Replication - update to 11.4.0.5-5826
IBM SPSS Modeler - update to 19.0.0.0 IF035
jackson-parent - update to 2.18.4-1.fc44
jackson-annotations - update to 2.18.11-150200.3.28.1
jackson-dataformat-cbor - update to 2.18.11-150200.3.29.1
jackson-core - update to 2.18.11-150200.3.30.1
jackson-databind - update to 2.18.11-150200.3.36.1
jackson-dataformat-xml - update to 2.18.11-150200.5.8.1
jackson-modules-base - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-jaxrs-providers - update to 2.18.12-1.fc44
jackson-databind - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-core - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-bom - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-annotations - update to 2.18.12-1.fc44
jackson-core (Red Hat package) - update to 2.21.6-1.el9_8.2
fasterxml-oss-parent - update to 69-1.fc44
Db2 Developer Extension - update to 1.2.1
IBM Netezza Performance Server - update to 11.3.1.3 IF6

External References

Related Security Bulletins