jackson-core - Debian Package Tracker

general

source: jackson-core (main)
version: 2.14.1-2
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Markus Koschany [DMD] – Mechtilde Stehmann [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.12.1-1
o-o-sec: 2.14.1-2~deb11u1
oldstable: 2.14.1-2~deb12u1
old-sec: 2.14.1-2~deb12u1
old-p-u: 2.14.1-2~deb12u1
stable: 2.14.1-2~deb13u1
stable-sec: 2.14.1-2~deb13u1
testing: 2.14.1-2
unstable: 2.14.1-2

versioned links

2.12.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.14.1-2~deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.14.1-2~deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.14.1-2~deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.14.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libjackson2-core-java

action needed

A new upstream version is available: 3.2.3 high

A new upstream version 3.2.3 is available, you should consider packaging it.

Created: 2025-11-27 Last update: 2026-10-03 10:32

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-89425: UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Created: 2026-09-23 Last update: 2026-09-24 11:02

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-89425: UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Created: 2026-09-23 Last update: 2026-09-24 11:02

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-89425: UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Created: 2026-09-23 Last update: 2026-09-24 11:02

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-89425: UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Created: 2026-09-23 Last update: 2026-09-24 11:02

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2026-10-03 Last update: 2026-10-03 16:30

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

libjackson2-core-java could be marked Multi-Arch: foreign

Created: 2016-09-14 Last update: 2026-10-03 11:30

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2022-12-20 Last update: 2026-04-16 09:02

debian/patches: 2 patches to forward upstream low

Among the 3 debian patches available in version 2.14.1-2 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-04-16 11:47

news

[rss feed]

[2026-06-11] Accepted jackson-core 2.14.1-2~deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Markus Koschany)
[2026-06-11] Accepted jackson-core 2.14.1-2~deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Markus Koschany)
[2026-06-10] Accepted jackson-core 2.14.1-2~deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Markus Koschany)
[2026-06-10] Accepted jackson-core 2.14.1-2~deb12u1 (source) into oldstable-security (Debian FTP Masters) (signed by: Markus Koschany)
[2026-06-08] Accepted jackson-core 2.14.1-2~deb11u1 (source) into oldoldstable-security (Markus Koschany)
[2026-04-21] jackson-core 2.14.1-2 MIGRATED to testing (Debian testing watch)
[2026-04-15] Accepted jackson-core 2.14.1-2 (source) into unstable (Markus Koschany)
[2022-12-25] jackson-core 2.14.1-1 MIGRATED to testing (Debian testing watch)
[2022-12-19] Accepted jackson-core 2.14.1-1 (source) into unstable (Emmanuel Bourg)
[2022-11-17] jackson-core 2.14.0-2 MIGRATED to testing (Debian testing watch)
[2022-11-12] Accepted jackson-core 2.14.0-2 (source) into unstable (Markus Koschany)
[2022-11-12] Accepted jackson-core 2.14.0-1 (source) into unstable (Markus Koschany)
[2021-11-09] jackson-core 2.13.0-2 MIGRATED to testing (Debian testing watch)
[2021-11-04] Accepted jackson-core 2.13.0-2 (source) into unstable (Markus Koschany)
[2021-10-22] Accepted jackson-core 2.13.0-1 (source) into unstable (Markus Koschany)
[2021-01-22] jackson-core 2.12.1-1 MIGRATED to testing (Debian testing watch)
[2021-01-16] Accepted jackson-core 2.12.1-1 (source) into unstable (Emmanuel Bourg)
[2020-12-31] jackson-core 2.12.0-1 MIGRATED to testing (Debian testing watch)
[2020-12-26] Accepted jackson-core 2.12.0-1 (source) into unstable (Mechtilde Stehmann)
[2020-11-13] jackson-core 2.11.3-1 MIGRATED to testing (Debian testing watch)
[2020-11-08] Accepted jackson-core 2.11.3-1 (source) into unstable (Mechtilde Stehmann)
[2020-03-13] jackson-core 2.10.3-1 MIGRATED to testing (Debian testing watch)
[2020-03-08] Accepted jackson-core 2.10.3-1 (source) into unstable (Mechtilde Stehmann)
[2019-12-29] jackson-core 2.10.1-1 MIGRATED to testing (Debian testing watch)
[2019-12-23] Accepted jackson-core 2.10.1-1 (source) into unstable (Mechtilde Stehmann)
[2019-10-04] jackson-core 2.10.0-1 MIGRATED to testing (Debian testing watch)
[2019-09-28] Accepted jackson-core 2.10.0-1 (source) into unstable (Mechtilde Stehmann)
[2019-09-15] Accepted jackson-core 2.9.9-1 (source all) into unstable (Mechtilde Stehmann)
[2019-01-04] jackson-core 2.9.8-3 MIGRATED to testing (Debian testing watch)
[2018-12-29] Accepted jackson-core 2.9.8-3 (source) into unstable (Emmanuel Bourg)

bugs [bug history graph]

all: 2
RC: 1
I&N: 1
M&W: 0
F&P: 0
patch: 2

links

homepage
lintian (0, 2)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.14.1-2