The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength     constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to     an application that uses the async parser API can supply a number token of arbitrary length, leading to     excessive memory allocation and potential CPU exhaustion, resulting in a denial of service. The     synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on     which parsing API the application uses. Root cause: the async parsing path in     NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods.
    Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without     any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call     resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and     validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never     enforced on the async code path. Impact: an attacker sending a JSON document containing an arbitrarily     long number to an application using the async parser (for example a Spring WebFlux or other reactive     application) can cause unbounded allocation in the TextBuffer and an OutOfMemoryError. If the application     subsequently calls getBigIntegerValue() or getDecimalValue(), the JVM may additionally be tied up in     O(n^2) BigInteger parsing, causing CPU-based denial of service. No privileges or user interaction beyond     the ability to submit data for parsing are required. This issue affects     com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.5 and from 2.19.0 through 2.21.0,     and tools.jackson.core:jackson-core from 3.0.0 through 3.0.x. Versions prior to 2.15.0 are not affected,     because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in     jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that     GHSA-72hv-8253-57qq records the lower bound of the affected 2.x range as 2.0.0. (CVE-2026-18401)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-18401

medium Nessus Plugin ID 332069

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Aug 10, 2026, 11:58 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608102358
Version 1.4 Aug 10, 2026, 6:51 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608101851
Version 1.3 Aug 7, 2026, 12:24 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608071224
Version 1.2 Aug 6, 2026, 3:43 PM CVSS metrics ("CVSSv2 score" set to 5.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P") CVSS metrics ("CVSSv3 score" set to 7.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H") CVSSv2 severity (based on CVE-2026-18401, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608061543
Version 1.1 Aug 5, 2026, 6:51 AM New Plugin Feed: 202608050651