Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
cleanstart spark and sonarqube may accept huge JSON numbers
published 1 month ago
Summary
The asynchronous JSON parser used in the cleanstart spark-sc212-jdk17-py311 and cleanstart sonarqube packages does not limit how long a numeric value can be, allowing extremely large numbers in incoming data. This can consume excessive memory and potentially disrupt the service. Update to the latest versions of these packages or switch to a parser that enforces size limits to protect your systems.
What to do
- Update cleanstart spark-sc212-jdk17-py311 to version 3.4.4-r1.
- Update cleanstart sonarqube to version 26.7.0.124771-r4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | spark-sc212-jdk17-py311 |
< 3.4.4-r1 Fix: upgrade to 3.4.4-r1
|
| CleanStart | cleanstart | sonarqube |
< 26.7.0.124771-r4 Fix: upgrade to 26.7.0.124771-r4
|
Original advisory text
non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)
CVE-2026-18401 affects multiple packages. The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). See references for individual vulnerability details.
Timeline
Published29 Sep 2026
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CLEANSTART-2026-GT01967 · OSV
Track software like this
Free during beta