jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xml-commons-apisUpgrade velocityUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade pki-jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade stax-exUpgrade xml-commons-resolverUpgrade apache-commons-langUpgrade jackson-modules-baseUpgrade bea-stax-apiUpgrade glassfish-fastinfosetUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade jackson-bomUpgrade pki-servlet-engineUpgrade glassfish-jaxb-txw2Upgrade jackson-coreUpgrade javassist-javadocUpgrade pki-jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade apache-commons-netUpgrade xalan-j2Upgrade jackson-annotationsUpgrade jakarta-commons-httpclientUpgrade fasterxml-oss-parentUpgrade pki-jackson-coreUpgrade pki-jackson-databindUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade slf4jUpgrade javassistUpgrade jackson-parentUpgrade relaxngDatatypeUpgrade pki-jackson-jaxrs-providersUpgrade jackson-jaxrs-providersUpgrade pki-jackson-module-jaxb-annotations | Aug 11, 2025 | Jul 30, 2025 |
| Amazon Linux Ami 2 | — | Upgrade jackson-javadocUpgrade jackson | May 20, 2026 | May 20, 2026 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Jan 21, 2026 | Jan 20, 2026 |
| Debian | — | Upgrade jackson-core | Jun 27, 2025 | Jun 25, 2025 |
| Oracle_linux | — | Upgrade jackson-parentUpgrade jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade stax-exUpgrade jakarta-commons-httpclientUpgrade pki-jackson-jaxrs-providersUpgrade slf4jUpgrade velocityUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade pki-jackson-databindUpgrade pki-servlet-engineUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade pki-jackson-coreUpgrade pki-jackson-jaxrs-json-providerUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade xerces-j2Upgrade xsomUpgrade pki-jackson-module-jaxb-annotationsUpgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade xalan-j2Upgrade jackson-coreUpgrade apache-commons-netUpgrade jackson-bomUpgrade pki-jackson-annotationsUpgrade jackson-annotationsUpgrade jackson-modules-baseUpgrade jackson-databindUpgrade fasterxml-oss-parent | Aug 1, 2025 | Jun 25, 2025 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Jun 26, 2025 | Jun 25, 2025 |
| Redhat_linux | — | Upgrade javassistUpgrade javassist-javadocUpgrade pki-jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade apache-commons-netUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade relaxngDatatypeUpgrade jakarta-commons-httpclientUpgrade pki-jackson-jaxrs-json-providerUpgrade xsomUpgrade pki-jackson-databindUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade xalan-j2Upgrade jackson-parentUpgrade pki-jackson-coreUpgrade pki-jackson-annotationsUpgrade bea-stax-apiUpgrade xmlstreambufferUpgrade jackson-coreUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providersNo solution existsUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade glassfish-jaxb-txw2Upgrade jackson-bomUpgrade glassfish-jaxb-coreUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade fasterxml-oss-parentUpgrade xerces-j2Upgrade stax-exUpgrade slf4j-jdk14Upgrade pki-jackson-jaxrs-providersUpgrade jackson-modules-baseUpgrade xml-commons-resolverUpgrade pki-servlet-engine | Jul 9, 2025 | Jun 25, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.5Upgrade Splunk Enterprise to version 10.0.1Upgrade Splunk Enterprise to version 9.3.7Upgrade Splunk Enterprise to version 9.2.9 | Nov 12, 2025 | Jun 25, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub