Detections
Analytics

Echo: tools.jackson.core:jackson-core: security update to 3.1.4

high Tenable Self-Hosted Container Security Plugin ID 472281

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length
 constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The
 earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the
 integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends
 inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out
 of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the
 caller. As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without
 ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely.
 _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is
 never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by
 maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because
 Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap
 before the validator finally fires when the value completes. The equivalent fraction-path code is correct:
 _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects
 the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart()
 in NonBlockingUtf8JsonParserBase. Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus,
 Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely
 the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to
 cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and
 attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser,
 ReaderBasedJsonParser) and the async parser operating on complete input are not affected. Exploitation
 requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are
 needed. This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and
 from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior
 to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting --
 was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier
 releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x
 and 3.2.x release lines are not affected: those branches were created after the fix commit landed on
 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0,
 tagged 2026-06-08). (CVE-2026-68494)

Solution

Update the tools.jackson.core:jackson-core library and its related packages to version 3.1.4 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-68494

Plugin Details

Severity: High

ID: 472281

Version: Revision 1.1

Type: Local

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.61

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-68494

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/3/2026

Vulnerability Publication Date: 7/21/2026

Reference Information

CVE: CVE-2026-68494