[GHSA-72hv-8253-57qq] jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition

[anthonydahanne]

Updates

• References

Comments
Hello reviewers!
Requesting that the CVE ID for this advisory be set to CVE-2026-18401, assigned by HeroDevs (CNA, org 36c7be3b-2937-45df-85ea-ca7133ea542c) and published 2026-08-04. The CVE record cites this GHSA in its source.advisory field.

The advisory currently shows "No known CVE" and the OSV export in github/advisory-database has "aliases": [], so downstream consumers treat the GHSA and the CVE as two separate vulnerabilities. Setting the CVE ID would populate aliases and deduplicate them.

I have added the CVE record URL to the references, but the CVE ID field itself is not editable through this form

Thank you!

[github]

Hi there @cowtowncoder! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Adds a CVE.org reference for the jackson-core advisory, but does not associate the CVE alias.

Changes:

• Updates the modification timestamp.
• Adds the CVE-2026-18401 reference URL.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[anthonydahanne]

do the change

[anthonydahanne]

super seeded with #8982