[GHSA-r7wm-3cxj-wff9] jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

[anthonydahanne]

Updates

• Affected products
• Description
• References

Comments
Adding the CVE ID assigned by HeroDevs (CNA): CVE-2026-68494, published 2026-08-04. The CVE record cites this GHSA as its source advisory and links CVE-2026-18401 as the incomplete-fix parent.

Three corrections to the affected-version data:

The 2.22.x and 3.2.x lines appear to be missing. Per the upstream release notes the fix also shipped in 2.22.1 and 3.2.1, so >= 2.22.0, < 2.22.1 and >= 3.2.0, < 3.2.1 should be listed as affected. Users on those lines currently receive no alert.
The 2.x range has no lower bound (introduced: 0). maxNumberLength was introduced in 2.15.0, so releases before that have no constraint to bypass. Note GHSA-72hv-8253-57qq's OSV export already uses introduced: 2.15.0.
Minor factual error in the description: "The parent advisory was scored CVSS 8.7 High" — GHSA-72hv-8253-57qq is scored 6.9 Moderate. 8.7 is this advisory's score.

[github]

Hi there @cowtowncoder! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Updates the jackson-core advisory with corrected affected ranges, severity details, and the newly assigned CVE reference.

Changes:

• Adds affected 2.22.x and 3.2.x ranges.
• Sets the 2.x introduction boundary to 2.15.0.
• Corrects the parent advisory’s severity and adds a CVE reference.

Suppressed comments (1)

advisories/github-reviewed/2026/07/GHSA-r7wm-3cxj-wff9/GHSA-r7wm-3cxj-wff9.json:139

• The newly assigned CVE is added only as a web reference, while the record still has "aliases": []. That prevents OSV consumers from correlating this GHSA with CVE-2026-68494; add the CVE ID to the top-level aliases array as done for other CVE-backed advisories (for example, GHSA-48rx-c7pg-q66r.json:6-8).

      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[anthonydahanne]

super seeded by #8984