[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-OPENSUSE-SU-2026:21201-1":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":22,"duplicates":23,"related":24,"reserved_at":9,"published_at":29,"modified_at":30,"state":9,"summary":31,"references_raw":33,"kevs":73,"epss":9,"epss_history":74,"metrics":75,"affected":76},"OPENSUSE-SU-2026:21201-1","Security update for jackson-annotations, jackson-core, jackson-databind\n\nThis update for jackson-annotations, jackson-core, jackson-databind fixes the following issues\n\n- CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows\n  arbitrary class instantiation (bsc#1268897).\n- CVE-2026-54513: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (bsc#1268898).\n- CVE-2026-54514: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899).\n- CVE-2026-54515: jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties\n  (bsc#1268902).\n- document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.8\n * No changes since 2.17.3\n\nChanges for jackson-core:\n\n- Update to 2.18.8\n * Changes of 2.18.8\n + #1611: Apply number-length validator on streaming integer path\n of async parser\n * Changes of 2.18.7\n + #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints\n .getMaxDocumentLength()' set\n (bsc#1268603, GHSA-2m67-wjpj-xhg9)\n + #1600: Rework 3rd party licenses in jar\n + #1602: 'UTF8DataInputJsonParser' needs to enforce\n 'StreamReadConstraints.maxNameLength' limit\n * Changes of 2.18.6\n + #1512: Number-parsing fix for 'UTF8DataInputJsonParser'\n + #1548: 'StreamReadConstraints.maxDocumentLength' not checked\n when creating parser with fixed buffer\n + #1555: Enforce 'StreamReadConstraints.maxNumberLength' for\n non-blocking (async) parser\n * Changes of 2.18.5\n + #1433: 'JsonParser#getNumberType()' throws\n 'JsonParseException' when the current token is non-numeric\n instead of returning null\n + #1446: Invalid package reference to \"java.lang.foreign\" from\n 'com.fasterxml.jackson.core:jackson-core' (from\n 'FastDoubleParser')\n * Changes of 2.18.3\n + #1391: Fix issue where the parser can read back old number\n state when parsing later numbers\n + #1397: Jackson changes additional values to infinite in case\n of special JSON structures and existing infinite values\n + #1398: Fix issue that feature\n COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom\n characterEscape is used\n * Changes of 2.18.2\n + #1359: Non-surrogate characters being incorrectly combined\n when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is\n enabled\n * Changes of 2.18.1\n + #1353: Use fastdoubleparser 1.0.90\n * Changes of 2.18.\n + #223: 'UTF8JsonGenerator' writes supplementary characters as a\n surrogate pair: should use 4-byte encoding\n + #1230: Improve performance of 'float' and 'double' parsing\n from 'TextBuffer'\n + #1251: 'InternCache' replace synchronized with 'ReentrantLock'\n - the cache size limit is no longer strictly enforced for\n performance reasons but we should never go far about the limit\n + #1252: 'ThreadLocalBufferManager' replace synchronized with\n 'ReentrantLock'\n + #1257: Increase InternCache default max size from 100 to 200\n + #1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool'\n + #1264: Rename shaded 'ch.randelshofer:fastdoubleparser'\n classes to prevent use by downstream consumers\n + #1271: Deprecate 'LockFreePool' implementation in 2.18 (remove\n from 3.0)\n + #1274: 'NUL'-corrupted keys, values on JSON serialization\n + #1277: Add back Java 22 optimisation in FastDoubleParser\n + #1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue()\n /getDecimalValue()' to avoid String allocation\n + #1305: Make helper methods of 'WriterBasedJsonGenerator'\n non-final to allow overriding\n + #1310: Add new 'StreamReadConstraints' ('maxTokenCount') to\n limit maximum number of Tokens allowed per document#\n + #1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal'\n decoding proble\n\nChanges for jackson-databind:\n\n- Update to 2.18.8\n * Changes of 2.18.8\n + #5950: Improve 'UUIDeserializer' error handling\n + #5951: Improve 'InetSocketAddress' deserialization\n (bsc#1268899, CVE-2026-54514)\n + #5969: '@JsonView' by-passed for some \"setterless\" creator\n properties\n + #5971: '@JsonView' by-passed for unwrapped creator parameters\n + #5974: '@JsonIgnore' on Record property ignored with\n 'PropertyNamingStrategy'\n + #5981: 'BasicPolymorphicTypeValidator' setting\n 'allowIfSubTypeIsArray()' should validate element type\n (bsc#1268898, CVE-2026-54513)\n + #5988: 'PolymorphicTypeValidator' needs to validate generic\n type parameters too (bsc#1268897, CVE-2026-54512)\n + #5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls'\n fold case using JVM default locale (Turkish-I bug)\n * Changes of 2.18.4\n + #4628: '@JsonIgnore' and '@JsonProperty.access=READ_ONLY' on\n Record property ignored for deserialization\n + #5049: Duplicate creator property \"b\" (index 0 vs 1) on simple\n java record\n * Changes of 2.18.3\n + #4444: The 'KeyDeserializer' specified in the class with\n '@JsonDeserialize(keyUsing = ...)' is overwritten by the\n 'KeyDeserializer' specified in the 'ObjectMapper'.\n + #4827: Subclassed Throwable deserialization fails since\n v2.18.0 - no creator index for property 'cause'\n + #4844: Fix wrapped array handling wrt 'null' by\n 'StdDeserializer'\n + #4848: Avoid type pollution in 'StringCollectionDeserializer'\n + #4860: 'ConstructorDetector.USE_PROPERTIES_BASED' does not\n work with multiple constructors since 2.18\n + #4878: When serializing a Map via\n Converter(StdDelegatingSerializer), a NullPointerException is\n thrown due to missing key serializer\n + #4908: Deserialization behavior change with @JsonCreator and\n @ConstructorProperties between 2.17 and 2.18\n + #4917: 'BigDecimal' deserialization issue when using\n '@JsonCreator'\n + #4920: Creator properties are ignored on abstract types when\n collecting bean properties, breaking AsExternalTypeDeserializer\n + #4922: Failing '@JsonMerge' with a custom Map\n + #4932: Conversion of 'MissingNode' throws\n 'JsonProcessingException'\n * Changes of 2.18.2\n + #4733: Wrong serialization of Type Ids for certain types of\n Enum values\n + #4742: Deserialization with Builder, External type id,\n '@JsonCreator' failing\n + #4777: 'StdValueInstantiator.withArgsCreator' is now set for\n creators with no arguments\n + #4783 Possibly wrong behavior of @JsonMerge\n + #4787: Wrong 'String.format()' in 'StdDelegatingDeserializer'\n hides actual error\n + #4788: 'EnumFeature.WRITE_ENUMS_TO_LOWERCASE' overrides\n '@JsonProperty' values\n + #4790: Fix '@JsonAnySetter' issue with \"setter\" method\n (related to #4639)\n + #4807: Improve 'FactoryBasedEnumDeserializer' to work better\n with XML module\n + #4810: Deserialization using '@JsonCreator' with renamed\n property failing (since 2.18)\n * Changes of 2.18.1\n + #4508: Deserialized JsonAnySetter field in Kotlin data class\n is null\n + #4639: @JsonAnySetter on field ignoring unrecognized\n properties if they are declared before the last recognized\n properties in JSON\n + #4718: Should not fail on trying to serialize\n 'java.time.DateTimeException'\n + #4724: Deserialization behavior change with Records,\n '@JsonCreator' and '@JsonValue' between 2.17 and 2.18\n + #4727: Eclipse having issues due'module-info' class \"lost\" on\n 2.18.0 jars\n + #4741: When 'Include.NON_DEFAULT' setting is used on POJO,\n empty values are not included in json if default is 'null'\n + #4749: Fixed a problem with\n 'StdDelegatingSerializer#serializeWithType' looking up the\n serializer with the wrong argument\n * Changes of 2.18.0\n + #562: Allow '@JsonAnySetter' to flow through Creators\n + #806: Problem with 'NamingStrategy', creator methods with\n implicit names\n + #2977: Incompatible 'FAIL_ON_MISSING_PRIMITIVE_PROPERTIES' and\n field level '@JsonProperty'\n + #3120: Return 'ListIterator' from 'ArrayNode.elements()'\n + #3241: 'constructorDetector' seems to invalidate\n 'defaultSetterInfo' for nullability\n + #3439: Java Record '@JsonAnySetter' value is null after\n deserialization\n + #4085: '@JsonView' does not work on class-level for records\n + #4119: Exception when deserialization uses a record with a\n constructor property with 'access=READ_ONLY'\n + #4356: 'BeanDeserializerModifier::updateBuilder()' doesn't\n work for beans with Creator methods\n + #4407: 'null' type id handling does not work with\n 'writeTypePrefix()'\n + #4452: '@JsonProperty' not serializing field names properly on\n '@JsonCreator' in Record\n + #4453: Allow JSON Integer to deserialize into a single-arg\n constructor of parameter type 'double'\n + #4456: Rework locking in 'DeserializerCache'\n + #4458: Rework synchronized block from 'BeanDeserializerBase'\n + #4464: When 'Include.NON_DEFAULT' setting is used, 'isEmpty()'\n method is not called on the serializer\n + #4472: Rework synchronized block in 'TypeDeserializerBase'\n + #4483: Remove 'final' on method BeanSerializer.serialize()\n + #4515: Rewrite Bean Property Introspection logic in Jackson\n 2.x\n + #4545: Unexpected deserialization behavior with\n '@JsonCreator', '@JsonProperty' and javac '-parameters'\n + #4570: Deprecate 'ObjectMapper.canDeserialize()'/'ObjectMapper\n .canSerialize()'\n + #4580: Add 'MapperFeature\n .SORT_CREATOR_PROPERTIES_BY_DECLARATION_ORDER' to use Creator\n properties' declaration order for sorting\n + #4584: Provide extension point for detecting \"primary\"\n Constructor for Kotlin (and similar) data classes\n + #4602: Possible wrong use of _arrayDelegateDeserializer in\n BeanDeserializerBase::deserializeFromObjectUsingNonDefault()\n + #4617: Record property serialization order not preserved\n + #4626: '@JsonIgnore' on Record property ignored for\n deserialization, if there is getter override\n + #4630: '@JsonIncludeProperties', '@JsonIgnoreProperties'\n ignored when serializing Records, if there is getter override\n + #4634: '@JsonAnySetter' not working when annotated on both\n constructor parameter & field\n + #4678: Java records don't serialize with 'MapperFeature\n .REQUIRE_SETTERS_FOR_GETTERS'\n + #4688: Should allow deserializing with no-arg\n '@JsonCreator(mode = DELEGATING)'\n + #4694: Deserializing 'BigDecimal' with large number of\n decimals result in incorrect value\n + #4699: Add extra 'writeNumber()' method in 'TokenBuffer'\n + #4709: Add 'JacksonCollectors' with 'toArrayNode()'\n implementation\n + Fix #5962: Case-insensitive deserialization may use wrong\n @JsonIgnoreProperties (bsc#1268902, CVE-2026-54515)\n",null,[],[],[],[14,16,18,20],{"_key":15},"CVE-2026-54512",{"_key":17},"CVE-2026-54513",{"_key":19},"CVE-2026-54514",{"_key":21},"CVE-2026-54515",[],[],[25,26,27,28],{"_key":15},{"_key":17},{"_key":19},{"_key":21},"2026-07-01T09:02:16Z","2026-07-03T18:24:23.912686970Z",{"cisa_kev":32,"cisa_ransomware":32,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[34,40,44,48,52,56,61,65,69],{"url":35,"sources":36,"tags":38},"https://bugzilla.suse.com/1268603",[37],"osv_opensuse",[39],"REPORT",{"url":41,"sources":42,"tags":43},"https://bugzilla.suse.com/1268897",[37],[39],{"url":45,"sources":46,"tags":47},"https://bugzilla.suse.com/1268898",[37],[39],{"url":49,"sources":50,"tags":51},"https://bugzilla.suse.com/1268899",[37],[39],{"url":53,"sources":54,"tags":55},"https://bugzilla.suse.com/1268902",[37],[39],{"url":57,"sources":58,"tags":59},"https://www.suse.com/security/cve/CVE-2026-54512",[37],[60],"WEB",{"url":62,"sources":63,"tags":64},"https://www.suse.com/security/cve/CVE-2026-54513",[37],[60],{"url":66,"sources":67,"tags":68},"https://www.suse.com/security/cve/CVE-2026-54514",[37],[60],{"url":70,"sources":71,"tags":72},"https://www.suse.com/security/cve/CVE-2026-54515",[37],[60],[],[],[],[77,90,95],{"ecosystem":78,"name":79,"vendor":80,"product":81,"cpe_part":9,"purl_type":82,"purl_namespace":80,"purl_name":81,"source":9,"versions":83},"openSUSE","jackson-annotations","opensuse","jackson-annotations&distro=openSUSE Leap 16.0","rpm",[84],{"version":85,"is_range":86,"range_type":87,"version_start":9,"version_start_type":9,"version_end":88,"version_end_type":89,"fixed_in":9},"lt2_18_8_160000_1_1",true,"ecosystem","2.18.8-160000.1.1","excluding",{"ecosystem":78,"name":91,"vendor":80,"product":92,"cpe_part":9,"purl_type":82,"purl_namespace":80,"purl_name":92,"source":9,"versions":93},"jackson-core","jackson-core&distro=openSUSE Leap 16.0",[94],{"version":85,"is_range":86,"range_type":87,"version_start":9,"version_start_type":9,"version_end":88,"version_end_type":89,"fixed_in":9},{"ecosystem":78,"name":96,"vendor":80,"product":97,"cpe_part":9,"purl_type":82,"purl_namespace":80,"purl_name":97,"source":9,"versions":98},"jackson-databind","jackson-databind&distro=openSUSE Leap 16.0",[99],{"version":85,"is_range":86,"range_type":87,"version_start":9,"version_start_type":9,"version_end":88,"version_end_type":89,"fixed_in":9}]