## This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues: * CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues (bsc#1273856). * CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker- supplied URIs without restricting the URI scheme (bsc#1277883). * CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857). * CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125). * CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641). * CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for

* bsc#1273856

* bsc#1273857

* bsc#1277883

* bsc#1278008

* bsc#1280125

* bsc#1282491

* bsc#1282492

* bsc#1282505

* bsc#1282641

* bsc#1282645

Cross-

* CVE-2026-18401

* CVE-2026-19032

* CVE-2026-68494

* CVE-2026-68497

* CVE-2026-68498

* CVE-2026-83557

* CVE-2026-89407

* CVE-2026-89425

* CVE-2026-91776

* CVE-2026-91777

CVSS scores:

* CVE-2026-18401 ( SUSE ): 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

* CVE-2026-18401 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2026-18401 ( NVD ): 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

* CVE-2026-19032 ( SUSE ): 6.3