[GHSA-r7wm-3cxj-wff9] jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

[pjfanning]

Updates

• Affected products

Comments
I updated GHSA-r7wm-3cxj-wff9 but don't know if that automatically updates this. I changed the affected versions to remove some versions that weren't affected (2.22.0 and 3.2.0 were never affected)

[github]

Hi there @cowtowncoder! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Corrects the OSV advisory’s affected-version metadata.

Changes:

• Removes unaffected 2.22.0 and 3.2.0 ranges.
• Retains vulnerable ranges for earlier release lines.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pjfanning]

Copilot charged me 54.45 credits for this review despite the fact that I didn't request it.