Every CVE Search/ Get API key

CVE-2026-19032

jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

5.3 MediumFix available

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.57%Up 0.1 points since Sep 1, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

Record
CVE-2026-19032
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-470, CWE-610
Updated
2026-11-02
EUVDEUVD-2026-68961 5.3

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

Record
EUVD-2026-68961
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-wjgm-6hv5-3cvf 5.3

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Summary

A java.nio.file.Path field bound from untrusted JSON reaches JDKFromStringDeserializer.NioPathHelper.deserialize. The attacker string flows through new URI(value) → Path.of(uri), then on FileSystemNotFoundException into a ServiceLoader<FileSystemProvider> enumeration that calls provider.getPath(uri) on the first scheme-matching provider. No scheme is rejected, so untrusted JSON can drive an arbitrary registered provider under the default JsonMapper.builder().build().

Impact is bounded. The JDK built-in providers (file, jar/zipfs) do no network I/O and do not mount, so the path is inert without a side-effecting third-party provider. Binding Path from untrusted input is already an anti-pattern.

Description

NioPathHelper.deserialize performs provider resolution driven by the attacker URI (abridged; the real method also handles a Windows drive-letter prefix and wraps failures via ctxt.handleInstantiationProblem(...)):

int colonIx = value.indexOf(':');
if (colonIx < 0) { return Path.of(value); }
...
final URI uri = new URI(value);          // attacker-controlled URI string
try {
    return Path.of(uri);                  // resolves scheme -> may load a FileSystemProvider
} catch (FileSystemNotFoundException cause) {
    final String scheme = uri.getScheme();
    for (FileSystemProvider provider : ServiceLoader.load(FileSystemProvider.class)) {
        if (provider.getScheme().equalsIgnoreCase(scheme)) {
            return provider.getPath(uri);  // attacker scheme selects & drives a provider
        }
    }
    // no matching provider -> ctxt.handleInstantiationProblem(...) (throws by default)
}

The attacker's scheme selects the provider and the attacker's URI is passed to it; the enumeration also forces provider classloading during readValue. For built-in schemes like jar:, getPath throws FileSystemNotFoundException (a mount requires explicit newFileSystem), surfacing as a wrapped ValueInstantiationException with no terminal effect. Any mount, network I/O, or resource access depends entirely on the selected provider.

Vulnerable Code Location

  • src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java
    • STD_PATH → NioPathHelper.deserialize; NioPathHelper.deserialize body (new URI → Path.of(uri) → ServiceLoader.load(FileSystemProvider.class) → provider.getPath(uri)).

Proof of Concept

Two PoCs are provided.

PoC 2 registers a custom FileSystemProvider to show that attacker JSON reaches provider.getPath(attackerURI) inside readValue. Whether a third-party provider then does anything harmful is outside the library's control. The in-scope issue is PoC 1 — the jar:/arbitrary-scheme path reaching the ServiceLoader fallback with no scheme restriction.

PoC 1 — sink reached (built-in jar provider).

com/poc/Vuln04_PathProvider.java:

package com.poc;

import tools.jackson.databind.ObjectMapper;
import tools.jackson.databind.json.JsonMapper;
import java.nio.file.Path;

/**
 * Vuln 4: java.nio.file.Path deserialization resolves an attacker URI via
 * Path.of(uri) / ServiceLoader<FileSystemProvider>.
 */
public class Vuln04_PathProvider {
    public static class Config { public Path workdir; }

    public static void main(String[] args) throws Exception {
        ObjectMapper mapper = JsonMapper.builder().build();
        // jar: scheme forces FileSystemProvider resolution / mounting attempt on attacker URI.
        String json = "{\"workdir\":\"jar:file:/tmp/jackson_poc_evil.zip!/x\"}";
        System.out.println("Deserializing (default mapper): " + json);
        try {
            Config c = mapper.readValue(json, Config.class);
            System.out.println("Resolved Path = " + c.workdir + "  (class=" + (c.workdir==null?"null":c.workdir.getClass().getName()) + ")");
            System.out.println("RESULT: VULNERABLE - attacker URI scheme resolved through provider…
Record
GHSA-wjgm-6hv5-3cvf
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-470, CWE-610
Updated
2026-11-02
NVD 5.3

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

Record
CVE-2026-19032
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-470, CWE-610
Updated
2026-11-02
OSV 5.3

jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

Record
CVE-2026-19032
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-470, CWE-610
Updated
2026-11-02
OSVDEBIAN-CVE-2026-19032 5.3

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

Record
DEBIAN-CVE-2026-19032
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 48 moreShow less
OSVGHSA-wjgm-6hv5-3cvf 5.3

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Summary

A java.nio.file.Path field bound from untrusted JSON reaches JDKFromStringDeserializer.NioPathHelper.deserialize. The attacker string flows through new URI(value) → Path.of(uri), then on FileSystemNotFoundException into a ServiceLoader<FileSystemProvider> enumeration that calls provider.getPath(uri) on the first scheme-matching provider. No scheme is rejected, so untrusted JSON can drive an arbitrary registered provider under the default JsonMapper.builder().build().

Impact is bounded. The JDK built-in providers (file, jar/zipfs) do no network I/O and do not mount, so the path is inert without a side-effecting third-party provider. Binding Path from untrusted input is already an anti-pattern.

Description

NioPathHelper.deserialize performs provider resolution driven by the attacker URI (abridged; the real method also handles a Windows drive-letter prefix and wraps failures via ctxt.handleInstantiationProblem(...)):

int colonIx = value.indexOf(':');
if (colonIx < 0) { return Path.of(value); }
...
final URI uri = new URI(value);          // attacker-controlled URI string
try {
    return Path.of(uri);                  // resolves scheme -> may load a FileSystemProvider
} catch (FileSystemNotFoundException cause) {
    final String scheme = uri.getScheme();
    for (FileSystemProvider provider : ServiceLoader.load(FileSystemProvider.class)) {
        if (provider.getScheme().equalsIgnoreCase(scheme)) {
            return provider.getPath(uri);  // attacker scheme selects & drives a provider
        }
    }
    // no matching provider -> ctxt.handleInstantiationProblem(...) (throws by default)
}

The attacker's scheme selects the provider and the attacker's URI is passed to it; the enumeration also forces provider classloading during readValue. For built-in schemes like jar:, getPath throws FileSystemNotFoundException (a mount requires explicit newFileSystem), surfacing as a wrapped ValueInstantiationException with no terminal effect. Any mount, network I/O, or resource access depends entirely on the selected provider.

Vulnerable Code Location

  • src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java
    • STD_PATH → NioPathHelper.deserialize; NioPathHelper.deserialize body (new URI → Path.of(uri) → ServiceLoader.load(FileSystemProvider.class) → provider.getPath(uri)).

Proof of Concept

Two PoCs are provided.

PoC 2 registers a custom FileSystemProvider to show that attacker JSON reaches provider.getPath(attackerURI) inside readValue. Whether a third-party provider then does anything harmful is outside the library's control. The in-scope issue is PoC 1 — the jar:/arbitrary-scheme path reaching the ServiceLoader fallback with no scheme restriction.

PoC 1 — sink reached (built-in jar provider).

com/poc/Vuln04_PathProvider.java:

package com.poc;

import tools.jackson.databind.ObjectMapper;
import tools.jackson.databind.json.JsonMapper;
import java.nio.file.Path;

/**
 * Vuln 4: java.nio.file.Path deserialization resolves an attacker URI via
 * Path.of(uri) / ServiceLoader<FileSystemProvider>.
 */
public class Vuln04_PathProvider {
    public static class Config { public Path workdir; }

    public static void main(String[] args) throws Exception {
        ObjectMapper mapper = JsonMapper.builder().build();
        // jar: scheme forces FileSystemProvider resolution / mounting attempt on attacker URI.
        String json = "{\"workdir\":\"jar:file:/tmp/jackson_poc_evil.zip!/x\"}";
        System.out.println("Deserializing (default mapper): " + json);
        try {
            Config c = mapper.readValue(json, Config.class);
            System.out.println("Resolved Path = " + c.workdir + "  (class=" + (c.workdir==null?"null":c.workdir.getClass().getName()) + ")");
            System.out.println("RESULT: VULNERABLE - attacker URI scheme resolved through provider…
Record
GHSA-wjgm-6hv5-3cvf
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-470, CWE-610
Updated
2026-11-02
OSVRHLW-2026-09128b29f89dc8ed 5.6

Lightwell Security Advisory: jackson-databind 2.17.3.rhlw-00013

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.17.3.rhlw-00013 with backported fixes for CVE-2026-83557, CVE-2026-54512, CVE-2026-54515, CVE-2026-19032, CVE-2026-77310, CVE-2026-54514, CVE-2026-59888, and CVE-2026-54513.

CVE-2026-83557: jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

CVE-2026-54512: jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

CVE-2026-54515: jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

CVE-2026-19032: jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

CVE-2026-77310: jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

CVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.17.3 from Maven Central.

Record
RHLW-2026-09128b29f89dc8ed
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHLW-2026-804d65df1a73952a 5.3

Lightwell Security Advisory: jackson-databind 2.18.0.rhlw-00010

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.18.0.rhlw-00010 with backported fixes for CVE-2026-19032, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, CVE-2026-59889, and CVE-2026-83557.

CVE-2026-19032: jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

CVE-2026-54515: jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

CVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

CVE-2026-59889: jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

CVE-2026-83557: jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.18.0 from Maven Central.

Record
RHLW-2026-804d65df1a73952a
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-19032 5.3

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

Record
UBUNTU-CVE-2026-19032
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-06
OSVCLSA-2026-1789307500 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.17.3-tuxcare.2.

Record
CLSA-2026-1789307500
Updated
2026-11-02
OSVCLSA-2026-1789494210 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.2-tuxcare.1.

Record
CLSA-2026-1789494210
Updated
2026-11-02
OSVCLSA-2026-1791530917 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.8.11-tuxcare.1.

Record
CLSA-2026-1791530917
Updated
2026-11-02
OSVCLSA-2026-1791531399 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.11.1-tuxcare.1.

Record
CLSA-2026-1791531399
Updated
2026-11-02
OSVCLSA-2026-1791531441 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.11.3-tuxcare.1.

Record
CLSA-2026-1791531441
Updated
2026-11-02
OSVCLSA-2026-1791531494 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.9.10.3-tuxcare.1.

Record
CLSA-2026-1791531494
Updated
2026-11-02
OSVCLSA-2026-1791545828 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.17.1-tuxcare.1.

Record
CLSA-2026-1791545828
Updated
2026-11-02
OSVCLSA-2026-1791781917 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.13.4.2-tuxcare.1.

Record
CLSA-2026-1791781917
Updated
2026-11-02
OSVCLSA-2026-1791781946 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.12.7.1-tuxcare.1.

Record
CLSA-2026-1791781946
Updated
2026-11-02
OSVCLSA-2026-1791782090 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.2-tuxcare.1.

Record
CLSA-2026-1791782090
Updated
2026-11-02
OSVCLSA-2026-1792440931 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.9.9.3-tuxcare.1.

Record
CLSA-2026-1792440931
Updated
2026-11-02
OSVCLSA-2026-1792441007 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.15.0-tuxcare.1.

Record
CLSA-2026-1792441007
Updated
2026-11-02
OSVCLSA-2026-1792441009 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.13.4-tuxcare.1.

Record
CLSA-2026-1792441009
Updated
2026-11-02
OSVCLSA-2026-1792441019 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.9.10.7-tuxcare.1.

Record
CLSA-2026-1792441019
Updated
2026-11-02
OSVCLSA-2026-1792441036 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.9.9-tuxcare.1.

Record
CLSA-2026-1792441036
Updated
2026-11-02
OSVCLSA-2026-1792441055 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.9.9.1-tuxcare.1.

Record
CLSA-2026-1792441055
Updated
2026-11-02
OSVCLSA-2026-1792441073 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.13.3-tuxcare.1.

Record
CLSA-2026-1792441073
Updated
2026-11-02
OSVCLSA-2026-1792441135 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.9.10.6-tuxcare.1.

Record
CLSA-2026-1792441135
Updated
2026-11-02
OSVCLSA-2026-1792441154 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.9.10.4-tuxcare.1.

Record
CLSA-2026-1792441154
Updated
2026-11-02
OSVCLSA-2026-1792441195 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.9.8-tuxcare.1.

Record
CLSA-2026-1792441195
Updated
2026-11-02
OSVCLSA-2026-1792441222 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.9.10.1-tuxcare.1.

Record
CLSA-2026-1792441222
Updated
2026-11-02
OSVCLSA-2026-1792441229 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.14.3-tuxcare.1.

Record
CLSA-2026-1792441229
Updated
2026-11-02
OSVCLSA-2026-1792441292 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.10.4-tuxcare.1.

Record
CLSA-2026-1792441292
Updated
2026-11-02
OSVCLSA-2026-1792441308 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.10.5.1-tuxcare.1.

Record
CLSA-2026-1792441308
Updated
2026-11-02
OSVCLSA-2026-1792441342 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.13.2.2-tuxcare.1.

Record
CLSA-2026-1792441342
Updated
2026-11-02
OSVCLSA-2026-1792441360 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.10-tuxcare.1.

Record
CLSA-2026-1792441360
Updated
2026-11-02
OSVCLSA-2026-1792441426 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.4-tuxcare.1.

Record
CLSA-2026-1792441426
Updated
2026-11-02
OSVCLSA-2026-1792441448 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.3-tuxcare.1.

Record
CLSA-2026-1792441448
Updated
2026-11-02
OSVCLSA-2026-1792441468 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.10.0-tuxcare.1.

Record
CLSA-2026-1792441468
Updated
2026-11-02
OSVCLSA-2026-1792441542 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.12.1-tuxcare.2.

Record
CLSA-2026-1792441542
Updated
2026-11-02
OSVCLSA-2026-1792441587 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.9.10.8-tuxcare.1.

Record
CLSA-2026-1792441587
Updated
2026-11-02
OSVCLSA-2026-1792441664 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.2-tuxcare.1.

Record
CLSA-2026-1792441664
Updated
2026-11-02
OSVCLSA-2026-1792441729 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.21.4-tuxcare.1.

Record
CLSA-2026-1792441729
Updated
2026-11-02
OSVCLSA-2026-1792441755 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.18.5-tuxcare.1.

Record
CLSA-2026-1792441755
Updated
2026-11-02
OSVCLSA-2026-1792441757 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.6-tuxcare.1.

Record
CLSA-2026-1792441757
Updated
2026-11-02
OSVCLSA-2026-1792441770 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.11.4-tuxcare.1.

Record
CLSA-2026-1792441770
Updated
2026-11-02
OSVCLSA-2026-1792441785 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.7-tuxcare.1.

Record
CLSA-2026-1792441785
Updated
2026-11-02
OSVCLSA-2026-1792441869 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.6.1-tuxcare.1.

Record
CLSA-2026-1792441869
Updated
2026-11-02
OSVCLSA-2026-1792441919 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.18.8-tuxcare.1.

Record
CLSA-2026-1792441919
Updated
2026-11-02
OSVCLSA-2026-1792474422 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (11 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 11 CVEs. Fixed in 2.11.2-tuxcare.1.

Record
CLSA-2026-1792474422
Updated
2026-11-02
OSVCLSA-2026-1792474453 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (20 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 20 CVEs. Fixed in 2.9.10.5-tuxcare.1.

Record
CLSA-2026-1792474453
Updated
2026-11-02
OSVCLSA-2026-1792475167 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.16.1-tuxcare.1.

Record
CLSA-2026-1792475167
Updated
2026-11-02
OSVCLSA-2026-1792478714 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.13.5-tuxcare.1.

Record
CLSA-2026-1792478714
Updated
2026-11-02
OSVCLSA-2026-1792479357 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.2-tuxcare.3.

Record
CLSA-2026-1792479357
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tools.jackson.core:jackson-databind
Maven
 3.0.0 up to 3.1.6
3.1.6
tools.jackson.core:jackson-databind
Maven
 3.2.0 up to 3.2.2
3.2.2
com.fasterxml.jackson.core:jackson-databind
Maven
 2.8.0 up to 2.18.10
2.18.10
com.fasterxml.jackson.core:jackson-databind
Maven
 2.19.0 up to 2.21.6
2.21.6
com.fasterxml.jackson.core:jackson-databind
Maven
 2.22.0 up to 2.22.2
2.22.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 2 CVEs
 2.17.3 up to 2.17.3-tuxcare.2, plus listed versions
2.17.3-tuxcare.1
2.17.3-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.17.2 up to 2.17.2-tuxcare.1
2.17.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.8.11 up to 2.8.11-tuxcare.1
2.8.11-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.11.1 up to 2.11.1-tuxcare.1
2.11.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.11.3 up to 2.11.3-tuxcare.1
2.11.3-tuxcare.1
Show 156 moreShow less
Affected packages
PackageAffectedFixed
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 9 CVEs
 2.9.10.3 up to 2.9.10.3-tuxcare.1
2.9.10.3-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.17.1 up to 2.17.1-tuxcare.1
2.17.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.13.4.2 up to 2.13.4.2-tuxcare.1
2.13.4.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 3 CVEs
 2.12.7.1 up to 2.12.7.1-tuxcare.1
2.12.7.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.12.2 up to 2.12.2-tuxcare.1
2.12.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.9.9.3 up to 2.9.9.3-tuxcare.1
2.9.9.3-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.15.0 up to 2.15.0-tuxcare.1
2.15.0-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 9 CVEs
 2.13.4 up to 2.13.4-tuxcare.1
2.13.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 11 CVEs
 2.9.10.7 up to 2.9.10.7-tuxcare.1
2.9.10.7-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.9.9 up to 2.9.9-tuxcare.1
2.9.9-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.9.9.1 up to 2.9.9.1-tuxcare.1
2.9.9.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.13.3 up to 2.13.3-tuxcare.1
2.13.3-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 9 CVEs
 2.9.10.6 up to 2.9.10.6-tuxcare.1
2.9.10.6-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 9 CVEs
 2.9.10.4 up to 2.9.10.4-tuxcare.1
2.9.10.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.9.8 up to 2.9.8-tuxcare.1
2.9.8-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.9.10.1 up to 2.9.10.1-tuxcare.1
2.9.10.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.14.3 up to 2.14.3-tuxcare.1
2.14.3-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.10.4 up to 2.10.4-tuxcare.1
2.10.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.10.5.1 up to 2.10.5.1-tuxcare.1
2.10.5.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.13.2.2 up to 2.13.2.2-tuxcare.1
2.13.2.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.9.10 up to 2.9.10-tuxcare.1
2.9.10-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.15.4 up to 2.15.4-tuxcare.1
2.15.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.15.3 up to 2.15.3-tuxcare.1
2.15.3-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.10.0 up to 2.10.0-tuxcare.1
2.10.0-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.12.1 up to 2.12.1-tuxcare.2, plus listed versions
2.12.1-tuxcare.1
2.12.1-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.9.10.8 up to 2.9.10.8-tuxcare.1
2.9.10.8-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.15.2 up to 2.15.2-tuxcare.1
2.15.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.21.4 up to 2.21.4-tuxcare.1
2.21.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.18.5 up to 2.18.5-tuxcare.1
2.18.5-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.12.6 up to 2.12.6-tuxcare.1
2.12.6-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 9 CVEs
 2.11.4 up to 2.11.4-tuxcare.1
2.11.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.12.7 up to 2.12.7-tuxcare.1
2.12.7-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.12.6.1 up to 2.12.6.1-tuxcare.1
2.12.6.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.18.8 up to 2.18.8-tuxcare.1
2.18.8-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 10 CVEs
 2.11.2 up to 2.11.2-tuxcare.1
2.11.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 19 CVEs
 2.9.10.5 up to 2.9.10.5-tuxcare.1
2.9.10.5-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.16.1 up to 2.16.1-tuxcare.1
2.16.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.13.5 up to 2.13.5-tuxcare.1
2.13.5-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.14.2 up to 2.14.2-tuxcare.3, plus listed versions
2.14.2-tuxcare.12.14.2-tuxcare.2
2.14.2-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.19.2 up to 2.19.2-tuxcare.1
2.19.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.19.4 up to 2.19.4-tuxcare.1
2.19.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.19.0 up to 2.19.0-tuxcare.1
2.19.0-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.20.1 up to 2.20.1-tuxcare.1
2.20.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.8.11.3 up to 2.8.11.3-tuxcare.1
2.8.11.3-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.8.10 up to 2.8.10-tuxcare.1
2.8.10-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.8.5 up to 2.8.5-tuxcare.1
2.8.5-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.8.11.1 up to 2.8.11.1-tuxcare.1
2.8.11.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.8.7 up to 2.8.7-tuxcare.1
2.8.7-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.8.11.4 up to 2.8.11.4-tuxcare.1
2.8.11.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.8.4 up to 2.8.4-tuxcare.1
2.8.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.9.1 up to 2.9.1-tuxcare.1
2.9.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.9.7 up to 2.9.7-tuxcare.1
2.9.7-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.9.2 up to 2.9.2-tuxcare.1
2.9.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.9.5 up to 2.9.5-tuxcare.1
2.9.5-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.10.3 up to 2.10.3-tuxcare.1
2.10.3-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.10.2 up to 2.10.2-tuxcare.1
2.10.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.11.0 up to 2.11.0-tuxcare.1
2.11.0-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.12.5 up to 2.12.5-tuxcare.1
2.12.5-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.9.4 up to 2.9.4-tuxcare.1
2.9.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.12.4 up to 2.12.4-tuxcare.1
2.12.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.16.0 up to 2.16.0-tuxcare.1
2.16.0-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.17.0 up to 2.17.0-tuxcare.1
2.17.0-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.16.2 up to 2.16.2-tuxcare.1
2.16.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.13.0 up to 2.13.0-tuxcare.1
2.13.0-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.13.1 up to 2.13.1-tuxcare.1
2.13.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.15.1 up to 2.15.1-tuxcare.1
2.15.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.18.4 up to 2.18.4-tuxcare.2, plus listed versions
2.18.4-tuxcare.1
2.18.4-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.14.1 up to 2.14.1-tuxcare.2, plus listed versions
2.14.1-tuxcare.1
2.14.1-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
 2.21.2 up to 2.21.2-tuxcare.2, plus listed versions
2.21.2-tuxcare.1
2.21.2-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 2 CVEs
 2.18.3 up to 2.18.3-tuxcare.5, plus listed versions
2.18.3-tuxcare.12.18.3-tuxcare.22.18.3-tuxcare.32.18.3-tuxcare.4
2.18.3-tuxcare.5
tools.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 2 CVEs
 3.1.2 up to 3.1.2-tuxcare.4, plus listed versions
3.1.2-tuxcare.13.1.2-tuxcare.23.1.2-tuxcare.3
3.1.2-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
 2.18.0 up to 2.18.0-tuxcare.4, plus listed versions
2.18.0-tuxcare.12.18.0-tuxcare.22.18.0-tuxcare.3
2.18.0-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.18.2 up to 2.18.2-tuxcare.4, plus listed versions
2.18.2-tuxcare.12.18.2-tuxcare.22.18.2-tuxcare.3
2.18.2-tuxcare.4
jackson-databind
Debian:12
 All versions, plus listed versions
2.14.0+ds-12.14.0+ds-22.14.0+ds-32.14.0-12.14.0-1+deb12u12.18.11-1
 None known
jackson-databind
Debian:13
 All versions, plus listed versions
2.14.0+ds-12.14.0+ds-1+deb13u12.14.0+ds-22.14.0+ds-32.18.11-1
 None known
jackson-databind
Debian:14
 before 2.18.11-1, plus listed versions
2.14.0+ds-12.14.0+ds-22.14.0+ds-3
2.18.11-1
tools.jackson.core:jackson-databind
Maven
 3.0.0 up to 3.1.6, plus listed versions
3.0.13.0.23.0.33.0.43.1.0
Show 6 moreShow less
3.1.0-rc13.1.13.1.23.1.33.1.43.1.5
3.1.6
tools.jackson.core:jackson-databind
Maven
 3.2.0 up to 3.2.2, plus listed versions
3.2.1
3.2.2
com.fasterxml.jackson.core:jackson-databind
Maven
 2.8.0 up to 2.18.10, plus listed versions
2.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.1
Show 45 moreShow less
2.10.22.10.32.10.42.10.52.10.5.12.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.6.12.12.72.12.7.12.12.7.22.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.2.12.13.2.22.13.32.13.42.13.4.12.13.4.22.13.52.14.02.14.0-rc12.14.0-rc22.14.0-rc32.14.12.14.22.14.32.15.02.15.0-rc1
2.18.10
com.fasterxml.jackson.core:jackson-databind
Maven
 2.19.0 up to 2.21.6, plus listed versions
2.19.12.19.22.19.32.19.42.20.0
Show 9 moreShow less
2.20.0-rc12.20.12.20.22.21.02.21.12.21.22.21.32.21.42.21.5
2.21.6
com.fasterxml.jackson.core:jackson-databind
Maven
 2.22.0 up to 2.22.2, plus listed versions
2.22.1
2.22.2
com.fasterxml.jackson.core:jackson-databind
Red Hat Lightwell:Maven
From an advisory covering 8 CVEs
 before 2.17.3.rhlw-00013, plus listed versions
2.0.02.0.0-RC12.0.0-RC22.0.0-RC32.0.1
Show 45 moreShow less
2.0.22.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.12.10.22.10.32.10.42.10.52.10.5.12.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.6.12.12.72.12.7.12.12.7.22.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.2.1
2.17.3.rhlw-00013
com.fasterxml.jackson.core:jackson-databind
Red Hat Lightwell:Maven
From an advisory covering 7 CVEs
 before 2.18.0.rhlw-00010, plus listed versions
2.0.02.0.0-RC12.0.0-RC22.0.0-RC32.0.1
Show 45 moreShow less
2.0.22.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.12.10.22.10.32.10.42.10.52.10.5.12.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.6.12.12.72.12.7.12.12.7.22.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.2.1
2.18.0.rhlw-00010
tools.jackson.core:jackson-databind
Root:Maven
 before 3.1.6-aikido.1
3.1.6-aikido.13.2.2-aikido.1
com.fasterxml.jackson.core:jackson-databind
Root:Maven
 before 2.18.10-aikido.1
2.18.10-aikido.12.21.6-aikido.12.22.2-aikido.1
io.root.tools.jackson.core:jackson-databind
Root:Maven
 before 3.1.6-root.io.1
3.1.6-root.io.13.2.2-root.io.1
io.root.com.fasterxml.jackson.core:jackson-databind
Root:Maven
 before 2.18.10-root.io.1
2.18.10-root.io.12.21.6-root.io.12.22.2-root.io.1
jackson-annotations
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-annotations
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
libjackson-json-java
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.9.2-11.9.2-21.9.2-31.9.2-3+deb8u1build0.14.04.1~esm1
 None known
libjackson-json-java
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.9.2-81.9.2-91.9.13-1~18.04
 None known
libjackson-json-java
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.9.13-1
 None known
libjackson-json-java
Ubuntu:26.10
 All versions, plus listed versions
1.9.13-2
 None known
jackson-databind
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 2.18.11-1.1
2.18.11-1.1
jackson-annotations
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1

History

History
RecordedChangedSources
affectedOSV
affected, aliasesOSV
affected
affected, aliases, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-19032 is a medium vulnerability (CVSS 5.3) in Fasterxml Jackson-databind, published September 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in tools.jackson.core:jackson-databind 3.1.6.

References

Show 116 moreShow less
This page doesn't list everything

Left out here: 372 versions and the rest of 2 source descriptions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 39 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open