{ "cveId": "CVE-2026-68494", "url": "https://patchblox.com/security/cve/CVE-2026-68494", "summary": "CVE-2026-68494 is fixed in 46 products on 1 platform, first by ALAS2023-2026-2067, released August 17, 2026. It is not reported as exploited. Patch Radar priority: High.", "title": "jackson-annotations: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).", "description": "Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).", "published": "2026-08-04T14:39:14Z", "severity": "important", "cvss": 7.5, "epss": 0.00463, "epssPercentile": 0.40593, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "eap8-activemq-artemis", "release": "RHEL 10", "fixedVersion": "2.40.0-8.redhat_00024.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-apache-cxf", "release": "RHEL 10", "fixedVersion": "4.1.7-1.SP1_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-artemis-wildfly-integration", "release": "RHEL 10", "fixedVersion": "2.0.5-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-bouncycastle", "release": "RHEL 10", "fixedVersion": "1.85.0-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-cryptacular", "release": "RHEL 10", "fixedVersion": "1.2.7-1.redhat_00002.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-eap-product-conf-parent", "release": "RHEL 10", "fixedVersion": "801.8.0-1.GA_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-hibernate", "release": "RHEL 10", "fixedVersion": "6.6.54-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-httpcomponents-asyncclient", "release": "RHEL 10", "fixedVersion": "4.1.5-5.redhat_00008.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-ironjacamar", "release": "RHEL 10", "fixedVersion": "3.0.22-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-annotations", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-core", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-databind", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-dataformats-text", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-jaxrs-providers", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-modules-base", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-modules-java8", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jakarta-xml-bind-api", "release": "RHEL 10", "fixedVersion": "4.0.5-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jaxb", "release": "RHEL 10", "fixedVersion": "4.0.7-4.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jaxbintros", "release": "RHEL 10", "fixedVersion": "2.1.0-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jboss-logging", "release": "RHEL 10", "fixedVersion": "3.6.3-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jboss-remoting", "release": "RHEL 10", "fixedVersion": "5.0.31-1.SP2_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jbossws-api", "release": "RHEL 10", "fixedVersion": "3.1.0-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jbossws-common-tools", "release": "RHEL 10", "fixedVersion": "2.2.0-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jbossws-cxf", "release": "RHEL 10", "fixedVersion": "7.4.0-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jbossws-jaxws-undertow-httpspi", "release": "RHEL 10", "fixedVersion": "3.0.1-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jbossws-spi", "release": "RHEL 10", "fixedVersion": "5.1.0-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jsf-impl", "release": "RHEL 10", "fixedVersion": "4.0.11-2.SP1_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-log4j", "release": "RHEL 10", "fixedVersion": "2.25.4-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-neethi", "release": "RHEL 10", "fixedVersion": "3.2.2-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-netty", "release": "RHEL 10", "fixedVersion": "4.1.136-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-netty-transport-native-epoll", "release": "RHEL 10", "fixedVersion": "4.1.136-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-nimbus-jose-jwt", "release": "RHEL 10", "fixedVersion": "9.37.4-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-parsson", "release": "RHEL 10", "fixedVersion": "1.1.9-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-saaj-impl", "release": "RHEL 10", "fixedVersion": "3.0.6-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-slf4j", "release": "RHEL 10", "fixedVersion": "2.0.18-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-undertow", "release": "RHEL 10", "fixedVersion": "2.3.26-2.SP3_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-wildfly", "release": "RHEL 10", "fixedVersion": "8.1.8-9.GA_redhat_00006.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-wildfly-elytron", "release": "RHEL 10", "fixedVersion": "2.6.11-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-wildfly-javadocs", "release": "RHEL 10", "fixedVersion": "8.1.1-12.GA_redhat_00048.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-ws-commons-XmlSchema", "release": "RHEL 10", "fixedVersion": "2.3.2-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-xml-security", "release": "RHEL 10", "fixedVersion": "3.0.6-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "jackson-annotations", "release": "opensuse-leap 16.0", "fixedVersion": "2.18.11-160000.1.1", "fix": "OPENSUSE-SU-2026:22034-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22034-1", "released": "2026-10-06T14:10:27Z" }, { "platform": "linux", "product": "jackson-annotations", "release": "sles 15.6", "fixedVersion": "2.18.11-150200.3.28.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-annotations", "release": "sles 15.7", "fixedVersion": "2.18.11-150200.3.28.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-annotations", "release": "sles 16.0", "fixedVersion": "2.18.11-160000.1.1", "fix": "SUSE-SU-2026:24149-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24149-1", "released": "2026-10-06T14:12:21Z" }, { "platform": "linux", "product": "jackson-core", "release": "amzn 2023", "fixedVersion": "2.21.5-2.amzn2023.0.1", "fix": "ALAS2023-2026-2067", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2067", "released": "2026-08-17T09:00:00Z" }, { "platform": "linux", "product": "jackson-core", "release": "opensuse-leap 16.0", "fixedVersion": "2.18.11-160000.1.1", "fix": "OPENSUSE-SU-2026:22034-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22034-1", "released": "2026-10-06T14:10:27Z" }, { "platform": "linux", "product": "jackson-core", "release": "sles 15.6", "fixedVersion": "2.18.11-150200.3.30.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-core", "release": "sles 15.7", "fixedVersion": "2.18.11-150200.3.30.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-core", "release": "sles 16.0", "fixedVersion": "2.18.11-160000.1.1", "fix": "SUSE-SU-2026:24149-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24149-1", "released": "2026-10-06T14:12:21Z" }, { "platform": "linux", "product": "jackson-databind", "release": "opensuse-leap 16.0", "fixedVersion": "2.18.11-160000.1.1", "fix": "OPENSUSE-SU-2026:22034-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22034-1", "released": "2026-10-06T14:10:27Z" }, { "platform": "linux", "product": "jackson-databind", "release": "sles 15.6", "fixedVersion": "2.18.11-150200.3.36.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-databind", "release": "sles 15.7", "fixedVersion": "2.18.11-150200.3.36.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-databind", "release": "sles 16.0", "fixedVersion": "2.18.11-160000.1.1", "fix": "SUSE-SU-2026:24149-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24149-1", "released": "2026-10-06T14:12:21Z" }, { "platform": "linux", "product": "jackson-dataformat-xml", "release": "sles 15.6", "fixedVersion": "2.18.11-150200.5.8.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-dataformat-xml", "release": "sles 15.7", "fixedVersion": "2.18.11-150200.5.8.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-dataformats-binary", "release": "sles 15.6", "fixedVersion": "2.18.11-150200.3.29.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" }, { "platform": "linux", "product": "jackson-dataformats-binary", "release": "sles 15.7", "fixedVersion": "2.18.11-150200.3.29.1", "fix": "SUSE-SU-2026:4394-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4394-1", "released": "2026-09-29T11:53:06Z" } ], "noFixYet": [], "dataAsOf": "2026-11-11T13:47:35Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }