SUSE-SU-2026:24149-1: important: Security update for jackson-annotations, jackson-core, jackson-databind

SLE-SECURITY-UPDATES null at suse.de
Thu Oct 15 12:41:23 UTC 2026 

# Security update for jackson-annotations, jackson-core, jackson-databind

Announcement ID: SUSE-SU-2026:24149-1  
Release Date: 2026-10-06T14:12:46Z  
Rating: important  
References:

  * bsc#1273856
  * bsc#1273857
  * bsc#1277883
  * bsc#1278008
  * bsc#1280125
  * bsc#1282491
  * bsc#1282492
  * bsc#1282505
  * bsc#1282641
  * bsc#1282645

  
Cross-References:

  * CVE-2026-18401
  * CVE-2026-19032
  * CVE-2026-68494
  * CVE-2026-68497
  * CVE-2026-68498
  * CVE-2026-83557
  * CVE-2026-89407
  * CVE-2026-89425
  * CVE-2026-91776
  * CVE-2026-91777

  
CVSS scores:

  * CVE-2026-18401 ( SUSE ):  6.9
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-18401 ( SUSE ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2026-18401 ( NVD ):  6.9
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-19032 ( SUSE ):  6.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-19032 ( SUSE ):  4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
  * CVE-2026-19032 ( NVD ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2026-68494 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-68494 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-68494 ( NVD ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-68497 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-68497 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-68497 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-68498 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-83557 ( SUSE ):  6.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-83557 ( SUSE ):  5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
  * CVE-2026-83557 ( NVD ):  5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
  * CVE-2026-89407 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-89407 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-89425 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-89425 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-89425 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-91776 ( SUSE ):  6.9
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-91776 ( SUSE ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2026-91776 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-91777 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-91777 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-91777 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  
Affected Products:

  * SUSE Linux Enterprise Server 16.0
  * SUSE Linux Enterprise Server for SAP applications 16.0

  
  
An update that solves 10 vulnerabilities can now be installed.

## Description:

This update for jackson-annotations, jackson-core, jackson-databind fixes the
following issues:

  * CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to
    Potential Processing Time Issues (bsc#1273856).
  * CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-
    supplied URIs without restricting the URI scheme (bsc#1277883).
  * CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit
    accumulation (bsc#1273857).
  * CVE-2026-68497: An unauthenticated attacker can therefore submit a single
    request of a few megabytes (bsc#1280125).
  * CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser
    (bsc#1282641).
  * CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for
    arbitrary `Comparable` deserialization (bsc#1278008).
  * CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
  * CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks
    `maxErrorTokenLength` limit, which allows for unbounded `StringBuilder`
    growth and can lead to a DoS when malformed tokens are processed
    (bsc#1282505).
  * CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the
    resolved deserializer under the raw, attacker- supplied type ID, which can
    lead to unbounded cache growth under certain configurations (bsc#1282491).
  * CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object
    IDs performs a linear scan of the pending- reference accumulator for every
    resolved ID, which can lead to quadratic CPU work during deserialization
    (bsc#1282492).

Changes for jackson-annotations:

  * Update to 2.18.11

Changes for jackson-core:

  * Update to 2.18.11
  * # 1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,

CVE-2026-89407)

  * # 1698: UTF8DataInputJsonParser does not honor

maxErrorTokenLength when reporting an unrecognized token (bsc#1282505,
CVE-2026-89425)

  * # 1642: Fix maxDocumentLength bypass in async parser

single-feedInput() case [GHSA-2c4j-63jj-9fqr]

  * # 1643: Enforce maxNameLength incrementally in

ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498) of async parser
(bsc#1273857, CVE-2026-68494) non-blocking (async) parser (bsc#1273856,
CVE-2026-18401)

Changes for jackson-databind:

  * Update to 2.18.11
  * # 6185: Bracket unresolved IPv6 host name in InetSocketAddress

serialization

  * # 6203: Prevent unbounded growth of type id cache in

TypeDeserializer (bsc#1282491, CVE-2026-91776)

  * # 6204: Avoid quadratic forward-reference resolution in

Collection/Map deserializers (bsc#1282492, CVE-2026-91777)

  * # 6099: Resolve classes without initialization in

TypeFactory.findClass()

  * # 6116: Reject non-ASCII digits in InetAddress literal validation

  * # 6127: Add StreamReadConstraints number len constraint to

javax.xml.datatype.XMLGregorianCalendar and javax.xml.datatype.Duration
(bsc#1280125, CVE-2026-68497)

  * # 6129: Limit the supported URL schemes for java.nio.file.Path

deserialization (bsc#1277883, CVE-2026-19032)

  * # 6156: Add java.lang.Comparable in set of unsafe polymorphic

base types (bsc#1278008, CVE-2026-83557)

  * # 6165: Apply number length limits to BigDecimal/BigInteger/

/Double/Float Map keys

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Server for SAP applications 16.0  
    zypper in -t patch SUSE-SLES-16.0-1850

  * SUSE Linux Enterprise Server 16.0  
    zypper in -t patch SUSE-SLES-16.0-1850

## Package List:

  * SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
    * jackson-annotations-2.18.11-160000.1.1
    * jackson-databind-javadoc-2.18.11-160000.1.1
    * jackson-databind-2.18.11-160000.1.1
    * jackson-core-2.18.11-160000.1.1
    * jackson-core-javadoc-2.18.11-160000.1.1
    * jackson-annotations-javadoc-2.18.11-160000.1.1
  * SUSE Linux Enterprise Server 16.0 (noarch)
    * jackson-annotations-2.18.11-160000.1.1
    * jackson-databind-javadoc-2.18.11-160000.1.1
    * jackson-databind-2.18.11-160000.1.1
    * jackson-core-2.18.11-160000.1.1
    * jackson-core-javadoc-2.18.11-160000.1.1
    * jackson-annotations-javadoc-2.18.11-160000.1.1

## References:

  * https://www.suse.com/security/cve/CVE-2026-18401.html
  * https://www.suse.com/security/cve/CVE-2026-19032.html
  * https://www.suse.com/security/cve/CVE-2026-68494.html
  * https://www.suse.com/security/cve/CVE-2026-68497.html
  * https://www.suse.com/security/cve/CVE-2026-68498.html
  * https://www.suse.com/security/cve/CVE-2026-83557.html
  * https://www.suse.com/security/cve/CVE-2026-89407.html
  * https://www.suse.com/security/cve/CVE-2026-89425.html
  * https://www.suse.com/security/cve/CVE-2026-91776.html
  * https://www.suse.com/security/cve/CVE-2026-91777.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1273856
  * https://bugzilla.suse.com/show_bug.cgi?id=1273857
  * https://bugzilla.suse.com/show_bug.cgi?id=1277883
  * https://bugzilla.suse.com/show_bug.cgi?id=1278008
  * https://bugzilla.suse.com/show_bug.cgi?id=1280125
  * https://bugzilla.suse.com/show_bug.cgi?id=1282491
  * https://bugzilla.suse.com/show_bug.cgi?id=1282492
  * https://bugzilla.suse.com/show_bug.cgi?id=1282505
  * https://bugzilla.suse.com/show_bug.cgi?id=1282641
  * https://bugzilla.suse.com/show_bug.cgi?id=1282645

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261015/7248656e/attachment.htm>

More information about the sle-security-updates mailing list