Skip to content

Improve GHSA-r7wm-3cxj-wff9 - #8984

Open
anthonydahanne wants to merge 1 commit into
github:anthonydahanne/advisory-improvement-8984from
anthonydahanne:anthonydahanne-GHSA-r7wm-3cxj-wff9
Open

anthonydahanne wants to merge 1 commit into
github:anthonydahanne/advisory-improvement-8984from
anthonydahanne:anthonydahanne-GHSA-r7wm-3cxj-wff9

Conversation

@anthonydahanne

@anthonydahanne anthonydahanne commented Aug 4, 2026

Copy link
Copy Markdown

Note

The original submission text below is struck through — it was written before the
2.22.x / 3.2.x ranges were removed from the diff. See the corrected summary
that follows.

Updates

  • Affected products
  • Description
  • References

Comments

Adding the CVE ID assigned by HeroDevs (CNA): CVE-2026-68494, published 2026-08-04. The CVE record cites this GHSA as its source advisory and links CVE-2026-18401 as the incomplete-fix parent.

Three corrections to the affected-version data:

The 2.22.x and 3.2.x lines appear to be missing. Per the upstream release notes the fix also shipped in 2.22.1 and 3.2.1, so >= 2.22.0, < 2.22.1 and >= 3.2.0, < 3.2.1 should be listed as affected. Users on those lines currently receive no alert.

The 2.x range has no lower bound (introduced: 0). maxNumberLength was introduced in 2.15.0, so releases before that have no constraint to bypass. Note GHSA-72hv-8253-57qq's OSV export already uses introduced: 2.15.0.

Minor factual error in the description: "The parent advisory was scored CVSS 8.7 High" — GHSA-72hv-8253-57qq is scored 6.9 Moderate. 8.7 is this advisory's score.


Links GHSA-r7wm-3cxj-wff9 to its assigned CVE and corrects three details in the record.

Changes

  1. aliases — set to ["CVE-2026-68494"]. Assigned by HeroDevs (CNA), published 2026-08-04. The CVE record names this GHSA in its source.advisory field. Without the alias, downstream consumers treat the GHSA and the CVE as two separate vulnerabilities.
  2. 2.x lower boundintroduced: 02.15.0. StreamReadConstraints and its maxNumberLength setting were introduced in jackson-core 2.15.0, so releases before that have no such constraint to bypass. GHSA-72hv-8253-57qq, the parent advisory, already uses introduced: 2.15.0.
  3. Description — "The parent advisory was scored CVSS 8.7 High" corrected to 6.9 Moderate. GHSA-72hv-8253-57qq is scored CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N (6.9); 8.7 is this advisory's own score.
  4. References — added the CVE record.

The three existing affected ranges are unchanged: 2.15.0 → 2.18.8, 2.19.0 → 2.21.4, 3.0.0 → 3.1.4.

Why 2.22.x and 3.2.x are not listed

An earlier revision of this PR added >= 2.22.0, < 2.22.1 and >= 3.2.0, < 3.2.1. That was wrong and both were removed — those lines were never affected.

The fix for this advisory is FasterXML/jackson-core#1611, released in 2.18.8 and 2.21.4 (28-May-2026) and 3.1.4 (29-May-2026):

The 2.22 and 3.2 branches were cut afterwards, so they carry the fix from their first release. [VERSION-2.x#L32-L35](https://github.com/FasterXML/jackson-core/blob/648eb6e5289236f28092c50d5b39072390327bb9/release-notes/VERSION-2.x#L32-L35) records 2.22.0 (03-Jun-2026) as "No changes since 2.21", and [VERSION#L40-L44](https://github.com/FasterXML/jackson-core/blob/648eb6e5289236f28092c50d5b39072390327bb9/release-notes/VERSION#L40-L44) shows 3.2.0 (08-Jun-2026) with 3.2.1 as "No changes since 3.2.0".

Verifiable against the fix commit:

$ git tag --contains 4cdd529749da396cc7edf6d4a2aad41d47902641
...
jackson-core-2.22.0
jackson-core-3.2.0

The commit merged 2026-05-21; jackson-core-2.22.0 was tagged 2026-06-03 and jackson-core-3.2.0 on 2026-06-08.

The unreleased 2.22.2 / 3.2.2 entries in the release notes are separate issues — #1630, #1642 (GHSA-2c4j-63jj-9fqr), #1643 (CVE-2026-68498) and #1649 — not #1611.

Copilot AI balanced review requested due to automatic review settings August 4, 2026 22:39
@github-actions
github-actions Bot changed the base branch from main to anthonydahanne/advisory-improvement-8984 August 4, 2026 22:41

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the Jackson async-parser advisory with new CVE metadata and revised affected-version information.

Changes:

  • Adds CVE-2026-68494 and its reference.
  • Corrects the lower bound and parent CVSS score.
  • Adds 2.22.x and 3.2.x ranges, though upstream evidence shows those releases already contain the fix.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread advisories/github-reviewed/2026/07/GHSA-r7wm-3cxj-wff9/GHSA-r7wm-3cxj-wff9.json Outdated
Comment thread advisories/github-reviewed/2026/07/GHSA-r7wm-3cxj-wff9/GHSA-r7wm-3cxj-wff9.json Outdated
Comment thread advisories/github-reviewed/2026/07/GHSA-r7wm-3cxj-wff9/GHSA-r7wm-3cxj-wff9.json Outdated
@anthonydahanne
anthonydahanne force-pushed the anthonydahanne-GHSA-r7wm-3cxj-wff9 branch from cd30fc0 to fd7a673 Compare August 5, 2026 01:46
@JonathanLEvans

Copy link
Copy Markdown

Hi @anthonydahanne,

Thank you for update. Could you provide a link that shows the fixes in 2.22.1 and 3.2.1? I found the release notes for v3 and v2 but they say the fix is in the unreleased versions of 2.22.2 and 3.2.2.

@anthonydahanne

Copy link
Copy Markdown
Author

Hello @JonathanLEvans !
My apologies: that claim is from the PR description, which I should have updated.
It's obsolete: I removed the 2.22.x and 3.2.x ranges from the diff on 5 Aug after @copilot correctly flagged the same problem.
Those lines are not patched in 2.22.1/3.2.1; they were never affected, so no range is needed for them.

The fix for this advisory is #1611, and the release notes place it in 2.18.8, 2.21.4 and 3.1.4:

VERSION-2.x#L188-L191 — 2.18.8 (28-May-2026)
VERSION-2.x#L49-L52 — 2.21.4 (28-May-2026)
VERSION#L86-L89 — 3.1.4 (29-May-2026)

The 2.22 and 3.2 branches were cut after that, so they carry the fix from their first release — VERSION-2.x#L32-L35 records 2.22.0 (03-Jun-2026) as "No changes since 2.21", and VERSION#L40-L44 shows 3.2.0 (08-Jun-2026) with 3.2.1 as "No changes since 3.2.0".

Verifiable directly against the fix commit:

$ git tag --contains 4cdd529749da396cc7edf6d4a2aad41d47902641
...
jackson-core-2.22.0
jackson-core-3.2.0

The commit merged 2026-05-21; jackson-core-2.22.0 was tagged 2026-06-03 and jackson-core-3.2.0 on 2026-06-08.

The 2.22.2 / 3.2.2 entries you found are separate issues — #1630, #1642 (GHSA-2c4j-63jj-9fqr), #1643 (CVE-2026-68498) and #1649 — not #1611.

So the current diff makes four changes only: sets aliases to ["CVE-2026-68494"]; raises the 2.x lower bound from 0 to 2.15.0 (maxNumberLength didn't exist before 2.15.0, so earlier releases have no constraint to bypass); corrects "The parent advisory was scored CVSS 8.7 High" to 6.9 Moderate; and adds the CVE record reference. The three existing affected ranges are unchanged.

@cowtowncoder cowtowncoder left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@anthonydahanne

Copy link
Copy Markdown
Author

Hello GH curators 👋
Please have another look: it's fixed and approved by @cowtowncoder !
Thank you 🙏

@anthonydahanne

Copy link
Copy Markdown
Author

👋

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants