Every CVE Search/ Get API key

CVE-2026-83557

jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

5.6 MediumFix available

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.72%Up 0.1 points since Sep 2, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.6

jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Record
CVE-2026-83557
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-502, CWE-915
Updated
2026-11-02
EUVDEUVD-2026-69250 5.6

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Record
EUVD-2026-69250
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-gx83-3vf8-gh7j 5.6

jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

Summary

DefaultBaseTypeLimitingValidator — the PolymorphicTypeValidator used automatically whenever @JsonTypeInfo is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific "unsafe base types" (Object, Serializable, Closeable, AutoCloseable, Cloneable, Runnable, java.util.logging.Handler, javax.naming.Referenceable, javax.sql.DataSource). Its isSafeSubType() returns true unconditionally for every other base type. java.lang.Comparable is not in that list, despite being implemented by a very large fraction of JDK and application classes — comparable in breadth to Serializable, which is denylisted for exactly that reason. An application with an @JsonTypeInfo-annotated Comparable-typed property, and no custom validator configured, will accept a type identifier for essentially any class implementing Comparable.

Details

Affected file: src/main/java/tools/jackson/databind/jsontype/DefaultBaseTypeLimitingValidator.java

private final static class UnsafeBaseTypes {
    private final Set<String> UNSAFE = new HashSet<>();
    {
        UNSAFE.add(Object.class.getName());
        UNSAFE.add(java.io.Closeable.class.getName());
        UNSAFE.add(java.io.Serializable.class.getName());
        UNSAFE.add(AutoCloseable.class.getName());
        UNSAFE.add(Cloneable.class.getName());
        UNSAFE.add(Runnable.class.getName());          // [databind#5014]
        UNSAFE.add("java.util.logging.Handler");
        UNSAFE.add("javax.naming.Referenceable");
        UNSAFE.add("javax.sql.DataSource");
        // java.lang.Comparable is NOT present here
    }
}

protected boolean isSafeSubType(DatabindContext ctxt,
        JavaType baseType, JavaType subType) {
    return true;   // unconditional for every base type not in UNSAFE
}

The class's own JavaDoc acknowledges the design ("Note that when using potentially unsafe base type like java.lang.Object a custom implementation... is needed"), so the trade-off of leaving broad base types unrestricted is intentional. The gap is that Comparable has the same breadth of implementers as the types this class does restrict, and its absence looks like an oversight rather than a deliberate choice — consistent with the ongoing, incremental nature of this list (Runnable was added recently for issue #5014).

This is specific to the default, unconfigured validator reached via bare @JsonTypeInfo usage. Global "Default Typing" via activateDefaultTyping() is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument — a correctly-configured BasicPolymorphicTypeValidator rejects the same payload under activateDefaultTyping().

PoC

Built entirely from source (jackson-databind + jackson-core + jackson-annotations, javac, OpenJDK 21, no third-party gadget libraries, no network access):

1. Sanity check (benign class, confirms the mechanism fires):

static class SafeThing implements Comparable<SafeThing> {
    public String name;
    public SafeThing() {}
    public int compareTo(SafeThing o) { return 0; }
}
static class Holder {
    @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
    public Comparable<?> value;
}

ObjectMapper mapper = JsonMapper.builder().build();   // no custom PTV
String json = "{\"value\":{\"@class\":\"...SafeThing\",\"name\":\"hello\"}}";
Holder h = mapper.readValue(json, Holder.class);
// RESULT: ACCEPTED, class=...SafeThing

2. Real JDK class substitution:

String json = "{\"value\":[\"java.io.File\",\"/etc/passwd\"]}";
Holder h = mapper.readValue(json, Holder.class);
// RESULT: ACCEPTED, class=java.io.File value=/etc/passwd

3. Negative control — Default Typing with an explicit custom PTV:

PolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()
    .allowIfSubType("PtvGapTest4").build();
ObjectMapper mapper = JsonMapper.builder()
   …
Record
GHSA-gx83-3vf8-gh7j
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-502, CWE-915
Updated
2026-11-02
NVD 5.6

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Record
CVE-2026-83557
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-502, CWE-915
Updated
2026-11-02
OSV 5.6

jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Record
CVE-2026-83557
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-502, CWE-915
Updated
2026-11-02
OSVDEBIAN-CVE-2026-83557 5.6

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Record
DEBIAN-CVE-2026-83557
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
Show 48 moreShow less
OSVGHSA-gx83-3vf8-gh7j 5.6

jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

Summary

DefaultBaseTypeLimitingValidator — the PolymorphicTypeValidator used automatically whenever @JsonTypeInfo is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific "unsafe base types" (Object, Serializable, Closeable, AutoCloseable, Cloneable, Runnable, java.util.logging.Handler, javax.naming.Referenceable, javax.sql.DataSource). Its isSafeSubType() returns true unconditionally for every other base type. java.lang.Comparable is not in that list, despite being implemented by a very large fraction of JDK and application classes — comparable in breadth to Serializable, which is denylisted for exactly that reason. An application with an @JsonTypeInfo-annotated Comparable-typed property, and no custom validator configured, will accept a type identifier for essentially any class implementing Comparable.

Details

Affected file: src/main/java/tools/jackson/databind/jsontype/DefaultBaseTypeLimitingValidator.java

private final static class UnsafeBaseTypes {
    private final Set<String> UNSAFE = new HashSet<>();
    {
        UNSAFE.add(Object.class.getName());
        UNSAFE.add(java.io.Closeable.class.getName());
        UNSAFE.add(java.io.Serializable.class.getName());
        UNSAFE.add(AutoCloseable.class.getName());
        UNSAFE.add(Cloneable.class.getName());
        UNSAFE.add(Runnable.class.getName());          // [databind#5014]
        UNSAFE.add("java.util.logging.Handler");
        UNSAFE.add("javax.naming.Referenceable");
        UNSAFE.add("javax.sql.DataSource");
        // java.lang.Comparable is NOT present here
    }
}

protected boolean isSafeSubType(DatabindContext ctxt,
        JavaType baseType, JavaType subType) {
    return true;   // unconditional for every base type not in UNSAFE
}

The class's own JavaDoc acknowledges the design ("Note that when using potentially unsafe base type like java.lang.Object a custom implementation... is needed"), so the trade-off of leaving broad base types unrestricted is intentional. The gap is that Comparable has the same breadth of implementers as the types this class does restrict, and its absence looks like an oversight rather than a deliberate choice — consistent with the ongoing, incremental nature of this list (Runnable was added recently for issue #5014).

This is specific to the default, unconfigured validator reached via bare @JsonTypeInfo usage. Global "Default Typing" via activateDefaultTyping() is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument — a correctly-configured BasicPolymorphicTypeValidator rejects the same payload under activateDefaultTyping().

PoC

Built entirely from source (jackson-databind + jackson-core + jackson-annotations, javac, OpenJDK 21, no third-party gadget libraries, no network access):

1. Sanity check (benign class, confirms the mechanism fires):

static class SafeThing implements Comparable<SafeThing> {
    public String name;
    public SafeThing() {}
    public int compareTo(SafeThing o) { return 0; }
}
static class Holder {
    @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
    public Comparable<?> value;
}

ObjectMapper mapper = JsonMapper.builder().build();   // no custom PTV
String json = "{\"value\":{\"@class\":\"...SafeThing\",\"name\":\"hello\"}}";
Holder h = mapper.readValue(json, Holder.class);
// RESULT: ACCEPTED, class=...SafeThing

2. Real JDK class substitution:

String json = "{\"value\":[\"java.io.File\",\"/etc/passwd\"]}";
Holder h = mapper.readValue(json, Holder.class);
// RESULT: ACCEPTED, class=java.io.File value=/etc/passwd

3. Negative control — Default Typing with an explicit custom PTV:

PolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()
    .allowIfSubType("PtvGapTest4").build();
ObjectMapper mapper = JsonMapper.builder()
   …
Record
GHSA-gx83-3vf8-gh7j
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-502, CWE-915
Updated
2026-11-02
OSVRHLW-2026-09128b29f89dc8ed 5.6

Lightwell Security Advisory: jackson-databind 2.17.3.rhlw-00013

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.17.3.rhlw-00013 with backported fixes for CVE-2026-83557, CVE-2026-54512, CVE-2026-54515, CVE-2026-19032, CVE-2026-77310, CVE-2026-54514, CVE-2026-59888, and CVE-2026-54513.

CVE-2026-83557: jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

CVE-2026-54512: jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

CVE-2026-54515: jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

CVE-2026-19032: jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

CVE-2026-77310: jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

CVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.17.3 from Maven Central.

Record
RHLW-2026-09128b29f89dc8ed
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHLW-2026-804d65df1a73952a 5.3

Lightwell Security Advisory: jackson-databind 2.18.0.rhlw-00010

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.18.0.rhlw-00010 with backported fixes for CVE-2026-19032, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, CVE-2026-59889, and CVE-2026-83557.

CVE-2026-19032: jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

CVE-2026-54515: jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

CVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

CVE-2026-59889: jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

CVE-2026-83557: jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.18.0 from Maven Central.

Record
RHLW-2026-804d65df1a73952a
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-83557 5.6

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Record
UBUNTU-CVE-2026-83557
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVCLSA-2026-1789307500 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.17.3-tuxcare.2.

Record
CLSA-2026-1789307500
Updated
2026-11-02
OSVCLSA-2026-1789494210 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.2-tuxcare.1.

Record
CLSA-2026-1789494210
Updated
2026-11-02
OSVCLSA-2026-1791545828 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.17.1-tuxcare.1.

Record
CLSA-2026-1791545828
Updated
2026-11-02
OSVCLSA-2026-1791781917 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.13.4.2-tuxcare.1.

Record
CLSA-2026-1791781917
Updated
2026-11-02
OSVCLSA-2026-1792441007 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.15.0-tuxcare.1.

Record
CLSA-2026-1792441007
Updated
2026-11-02
OSVCLSA-2026-1792441009 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.13.4-tuxcare.1.

Record
CLSA-2026-1792441009
Updated
2026-11-02
OSVCLSA-2026-1792441229 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.14.3-tuxcare.1.

Record
CLSA-2026-1792441229
Updated
2026-11-02
OSVCLSA-2026-1792441426 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.4-tuxcare.1.

Record
CLSA-2026-1792441426
Updated
2026-11-02
OSVCLSA-2026-1792441448 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.3-tuxcare.1.

Record
CLSA-2026-1792441448
Updated
2026-11-02
OSVCLSA-2026-1792441664 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.2-tuxcare.1.

Record
CLSA-2026-1792441664
Updated
2026-11-02
OSVCLSA-2026-1792475167 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.16.1-tuxcare.1.

Record
CLSA-2026-1792475167
Updated
2026-11-02
OSVCLSA-2026-1792478714 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.13.5-tuxcare.1.

Record
CLSA-2026-1792478714
Updated
2026-11-02
OSVCLSA-2026-1792479357 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.2-tuxcare.3.

Record
CLSA-2026-1792479357
Updated
2026-11-02
OSVCLSA-2026-1792516705 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.16.0-tuxcare.1.

Record
CLSA-2026-1792516705
Updated
2026-11-02
OSVCLSA-2026-1792517919 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.17.0-tuxcare.1.

Record
CLSA-2026-1792517919
Updated
2026-11-02
OSVCLSA-2026-1792517950 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.16.2-tuxcare.1.

Record
CLSA-2026-1792517950
Updated
2026-11-02
OSVCLSA-2026-1792517982 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.1-tuxcare.1.

Record
CLSA-2026-1792517982
Updated
2026-11-02
OSVCLSA-2026-1793200760 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.1-tuxcare.2.

Record
CLSA-2026-1793200760
Updated
2026-11-02
OSVCLSA-2026-1793208270 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.11.1-tuxcare.3.

Record
CLSA-2026-1793208270
Updated
2026-11-02
OSVCLSA-2026-1793208938 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.1-tuxcare.3.

Record
CLSA-2026-1793208938
Updated
2026-11-02
OSVCLSA-2026-1793209495 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.11.0-tuxcare.2.

Record
CLSA-2026-1793209495
Updated
2026-11-02
OSVCLSA-2026-1793273384 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.12.6.1-tuxcare.3.

Record
CLSA-2026-1793273384
Updated
2026-11-02
OSVCLSA-2026-1793274468 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.12.6-tuxcare.2.

Record
CLSA-2026-1793274468
Updated
2026-11-02
OSVCLSA-2026-1793274960 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.7-tuxcare.3.

Record
CLSA-2026-1793274960
Updated
2026-11-02
OSVCLSA-2026-1793295575 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.13.0-tuxcare.3.

Record
CLSA-2026-1793295575
Updated
2026-11-02
OSVCLSA-2026-1793348493 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.19.0-tuxcare.2.

Record
CLSA-2026-1793348493
Updated
2026-11-02
OSVCLSA-2026-1793348823 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.11.4-tuxcare.3.

Record
CLSA-2026-1793348823
Updated
2026-11-02
OSVCLSA-2026-1793348906 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.11.3-tuxcare.4.

Record
CLSA-2026-1793348906
Updated
2026-11-02
OSVCLSA-2026-1793349274 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.20.1-tuxcare.3.

Record
CLSA-2026-1793349274
Updated
2026-11-02
OSVCLSA-2026-1793349383 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.4-tuxcare.3.

Record
CLSA-2026-1793349383
Updated
2026-11-02
OSVCLSA-2026-1793362223 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.18.4-tuxcare.3.

Record
CLSA-2026-1793362223
Updated
2026-11-02
OSVCLSA-2026-1793363147 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.13.1-tuxcare.3.

Record
CLSA-2026-1793363147
Updated
2026-11-02
OSVCLSA-2026-1793522726 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.12.2-tuxcare.3.

Record
CLSA-2026-1793522726
Updated
2026-11-02
OSVCLSA-2026-1793531937 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.21.4-tuxcare.2.

Record
CLSA-2026-1793531937
Updated
2026-11-02
OSVCLSA-2026-1793532239 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.19.4-tuxcare.2.

Record
CLSA-2026-1793532239
Updated
2026-11-02
OSVCLSA-2026-1793532432 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.5-tuxcare.3.

Record
CLSA-2026-1793532432
Updated
2026-11-02
OSVCLSA-2026-1793532868 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.19.2-tuxcare.2.

Record
CLSA-2026-1793532868
Updated
2026-11-02
OSVCLSA-2026-1793533147 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.13.2.2-tuxcare.3.

Record
CLSA-2026-1793533147
Updated
2026-11-02
OSVCLSA-2026-1793544702 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.7.1-tuxcare.4.

Record
CLSA-2026-1793544702
Updated
2026-11-02
OSVCLSA-2026-1793544811 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.13.3-tuxcare.2.

Record
CLSA-2026-1793544811
Updated
2026-11-02
OSVCLSA-2026-1793544907 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.11.2-tuxcare.2.

Record
CLSA-2026-1793544907
Updated
2026-11-02
OSVCLSA-2026-1793866208 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (11 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 11 CVEs. Fixed in 2.8.7-tuxcare.6.

Record
CLSA-2026-1793866208
Updated
2026-11-05
OSVCLSA-2026-1793866335 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (11 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 11 CVEs. Fixed in 2.7.8-tuxcare.5.

Record
CLSA-2026-1793866335
Updated
2026-11-05
OSVCLSA-2026-1793866444 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.7.0-tuxcare.4.

Record
CLSA-2026-1793866444
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tools.jackson.core:jackson-databind
Maven
 3.0.0 up to 3.1.6
3.1.6
tools.jackson.core:jackson-databind
Maven
 3.2.0 up to 3.2.2
3.2.2
com.fasterxml.jackson.core:jackson-databind
Maven
 2.11.0 up to 2.18.10
2.18.10
com.fasterxml.jackson.core:jackson-databind
Maven
 2.19.0 up to 2.21.6
2.21.6
com.fasterxml.jackson.core:jackson-databind
Maven
 2.22.0 up to 2.22.2
2.22.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 2 CVEs
 2.17.3 up to 2.17.3-tuxcare.2, plus listed versions
2.17.3-tuxcare.1
2.17.3-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.17.2 up to 2.17.2-tuxcare.1
2.17.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.17.1 up to 2.17.1-tuxcare.1
2.17.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.13.4.2 up to 2.13.4.2-tuxcare.1
2.13.4.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.15.0 up to 2.15.0-tuxcare.1
2.15.0-tuxcare.1
Show 162 moreShow less
Affected packages
PackageAffectedFixed
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 9 CVEs
 2.13.4 up to 2.13.4-tuxcare.1
2.13.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.14.3 up to 2.14.3-tuxcare.1
2.14.3-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.15.4 up to 2.15.4-tuxcare.1
2.15.4-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.15.3 up to 2.15.3-tuxcare.1
2.15.3-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.15.2 up to 2.15.2-tuxcare.1
2.15.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.16.1 up to 2.16.1-tuxcare.1
2.16.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.13.5 up to 2.13.5-tuxcare.1
2.13.5-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.14.2 up to 2.14.2-tuxcare.3, plus listed versions
2.14.2-tuxcare.12.14.2-tuxcare.2
2.14.2-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.16.0 up to 2.16.0-tuxcare.1
2.16.0-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.17.0 up to 2.17.0-tuxcare.1
2.17.0-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.16.2 up to 2.16.2-tuxcare.1
2.16.2-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.15.1 up to 2.15.1-tuxcare.1
2.15.1-tuxcare.1
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.14.1 up to 2.14.1-tuxcare.2, plus listed versions
2.14.1-tuxcare.1
2.14.1-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.11.1 up to 2.11.1-tuxcare.3, plus listed versions
2.11.1-tuxcare.12.11.1-tuxcare.2
2.11.1-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.12.1 up to 2.12.1-tuxcare.3, plus listed versions
2.12.1-tuxcare.12.12.1-tuxcare.2
2.12.1-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.11.0 up to 2.11.0-tuxcare.2, plus listed versions
2.11.0-tuxcare.1
2.11.0-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.12.6.1 up to 2.12.6.1-tuxcare.3, plus listed versions
2.12.6.1-tuxcare.12.12.6.1-tuxcare.2
2.12.6.1-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 10 CVEs
 2.12.6 up to 2.12.6-tuxcare.2, plus listed versions
2.12.6-tuxcare.1
2.12.6-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.12.7 up to 2.12.7-tuxcare.3, plus listed versions
2.12.7-tuxcare.12.12.7-tuxcare.2
2.12.7-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.13.0 up to 2.13.0-tuxcare.3, plus listed versions
2.13.0-tuxcare.12.13.0-tuxcare.2
2.13.0-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 3 CVEs
 2.19.0 up to 2.19.0-tuxcare.2, plus listed versions
2.19.0-tuxcare.1
2.19.0-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 3 CVEs
 2.11.4 up to 2.11.4-tuxcare.3, plus listed versions
2.11.4-tuxcare.12.11.4-tuxcare.2
2.11.4-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 3 CVEs
 2.11.3 up to 2.11.3-tuxcare.4, plus listed versions
2.11.3-tuxcare.12.11.3-tuxcare.22.11.3-tuxcare.3
2.11.3-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 3 CVEs
 2.20.1 up to 2.20.1-tuxcare.3, plus listed versions
2.20.1-tuxcare.12.20.1-tuxcare.2
2.20.1-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.12.4 up to 2.12.4-tuxcare.3, plus listed versions
2.12.4-tuxcare.12.12.4-tuxcare.2
2.12.4-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.18.4 up to 2.18.4-tuxcare.3, plus listed versions
2.18.4-tuxcare.12.18.4-tuxcare.2
2.18.4-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.13.1 up to 2.13.1-tuxcare.3, plus listed versions
2.13.1-tuxcare.12.13.1-tuxcare.2
2.13.1-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 10 CVEs
 2.12.2 up to 2.12.2-tuxcare.3, plus listed versions
2.12.2-tuxcare.12.12.2-tuxcare.2
2.12.2-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 2 CVEs
 2.21.4 up to 2.21.4-tuxcare.2, plus listed versions
2.21.4-tuxcare.1
2.21.4-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.19.4 up to 2.19.4-tuxcare.2, plus listed versions
2.19.4-tuxcare.1
2.19.4-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.12.5 up to 2.12.5-tuxcare.3, plus listed versions
2.12.5-tuxcare.12.12.5-tuxcare.2
2.12.5-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.19.2 up to 2.19.2-tuxcare.2, plus listed versions
2.19.2-tuxcare.1
2.19.2-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 2 CVEs
 2.13.2.2 up to 2.13.2.2-tuxcare.3, plus listed versions
2.13.2.2-tuxcare.12.13.2.2-tuxcare.2
2.13.2.2-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.12.7.1 up to 2.12.7.1-tuxcare.4, plus listed versions
2.12.7.1-tuxcare.12.12.7.1-tuxcare.22.12.7.1-tuxcare.3
2.12.7.1-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.13.3 up to 2.13.3-tuxcare.2, plus listed versions
2.13.3-tuxcare.1
2.13.3-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.11.2 up to 2.11.2-tuxcare.2, plus listed versions
2.11.2-tuxcare.1
2.11.2-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 11 CVEs
 2.8.7 up to 2.8.7-tuxcare.6, plus listed versions
2.8.7-tuxcare.12.8.7-tuxcare.22.8.7-tuxcare.32.8.7-tuxcare.42.8.7-tuxcare.5
2.8.7-tuxcare.6
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 11 CVEs
 2.7.8 up to 2.7.8-tuxcare.5, plus listed versions
2.7.8-tuxcare.12.7.8-tuxcare.22.7.8-tuxcare.32.7.8-tuxcare.4
2.7.8-tuxcare.5
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 9 CVEs
 2.7.0 up to 2.7.0-tuxcare.4, plus listed versions
2.7.0-tuxcare.12.7.0-tuxcare.22.7.0-tuxcare.3
2.7.0-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 16 CVEs
 2.7.9.3 up to 2.7.9.3-tuxcare.4, plus listed versions
2.7.9.3-tuxcare.12.7.9.3-tuxcare.22.7.9.3-tuxcare.3
2.7.9.3-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 2 CVEs
 2.4.3 up to 2.4.3-tuxcare.4, plus listed versions
2.4.3-tuxcare.12.4.3-tuxcare.22.4.3-tuxcare.3
2.4.3-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 11 CVEs
 2.9.9 up to 2.9.9-tuxcare.3, plus listed versions
2.9.9-tuxcare.12.9.9-tuxcare.2
2.9.9-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 12 CVEs
 2.10.2 up to 2.10.2-tuxcare.4, plus listed versions
2.10.2-tuxcare.12.10.2-tuxcare.22.10.2-tuxcare.3
2.10.2-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.9.1 up to 2.9.1-tuxcare.3, plus listed versions
2.9.1-tuxcare.12.9.1-tuxcare.2
2.9.1-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 9 CVEs
 2.10.3 up to 2.10.3-tuxcare.4, plus listed versions
2.10.3-tuxcare.12.10.3-tuxcare.22.10.3-tuxcare.3
2.10.3-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.9.4 up to 2.9.4-tuxcare.5, plus listed versions
2.9.4-tuxcare.12.9.4-tuxcare.22.9.4-tuxcare.32.9.4-tuxcare.4
2.9.4-tuxcare.5
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 12 CVEs
 2.8.5 up to 2.8.5-tuxcare.5, plus listed versions
2.8.5-tuxcare.12.8.5-tuxcare.22.8.5-tuxcare.32.8.5-tuxcare.4
2.8.5-tuxcare.5
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 9 CVEs
 2.9.2 up to 2.9.2-tuxcare.4, plus listed versions
2.9.2-tuxcare.12.9.2-tuxcare.22.9.2-tuxcare.3
2.9.2-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 10 CVEs
 2.9.3 up to 2.9.3-tuxcare.6, plus listed versions
2.9.3-tuxcare.12.9.3-tuxcare.22.9.3-tuxcare.32.9.3-tuxcare.42.9.3-tuxcare.5
2.9.3-tuxcare.6
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 7 CVEs
 2.8.11.3 up to 2.8.11.3-tuxcare.4, plus listed versions
2.8.11.3-tuxcare.12.8.11.3-tuxcare.22.8.11.3-tuxcare.3
2.8.11.3-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.8.11 up to 2.8.11-tuxcare.5, plus listed versions
2.8.11-tuxcare.12.8.11-tuxcare.22.8.11-tuxcare.32.8.11-tuxcare.4
2.8.11-tuxcare.5
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.8.11.4 up to 2.8.11.4-tuxcare.4, plus listed versions
2.8.11.4-tuxcare.12.8.11.4-tuxcare.22.8.11.4-tuxcare.3
2.8.11.4-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.7.3 up to 2.7.3-tuxcare.4, plus listed versions
2.7.3-tuxcare.12.7.3-tuxcare.22.7.3-tuxcare.3
2.7.3-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 3 CVEs
 2.7.5 up to 2.7.5-tuxcare.5, plus listed versions
2.7.5-tuxcare.12.7.5-tuxcare.22.7.5-tuxcare.32.7.5-tuxcare.4
2.7.5-tuxcare.5
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.9.10.3 up to 2.9.10.3-tuxcare.6, plus listed versions
2.9.10.3-tuxcare.12.9.10.3-tuxcare.22.9.10.3-tuxcare.32.9.10.3-tuxcare.42.9.10.3-tuxcare.5
2.9.10.3-tuxcare.6
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 2 CVEs
 2.4.5 up to 2.4.5-tuxcare.4, plus listed versions
2.4.5-tuxcare.12.4.5-tuxcare.22.4.5-tuxcare.3
2.4.5-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 2 CVEs
 2.9.10.7 up to 2.9.10.7-tuxcare.4, plus listed versions
2.9.10.7-tuxcare.12.9.10.7-tuxcare.22.9.10.7-tuxcare.3
2.9.10.7-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.9.10.5 up to 2.9.10.5-tuxcare.2, plus listed versions
2.9.10.5-tuxcare.1
2.9.10.5-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.7.9.7 up to 2.7.9.7-tuxcare.5, plus listed versions
2.7.9.7-tuxcare.12.7.9.7-tuxcare.22.7.9.7-tuxcare.32.7.9.7-tuxcare.4
2.7.9.7-tuxcare.5
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 8 CVEs
 2.10.5.1 up to 2.10.5.1-tuxcare.4, plus listed versions
2.10.5.1-tuxcare.12.10.5.1-tuxcare.22.10.5.1-tuxcare.3
2.10.5.1-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.7.1 up to 2.7.1-tuxcare.6, plus listed versions
2.7.1-tuxcare.12.7.1-tuxcare.22.7.1-tuxcare.32.7.1-tuxcare.42.7.1-tuxcare.5
2.7.1-tuxcare.6
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 2 CVEs
 2.9.10.8 up to 2.9.10.8-tuxcare.4, plus listed versions
2.9.10.8-tuxcare.12.9.10.8-tuxcare.22.9.10.8-tuxcare.3
2.9.10.8-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 6 CVEs
 2.8.10 up to 2.8.10-tuxcare.6, plus listed versions
2.8.10-tuxcare.12.8.10-tuxcare.22.8.10-tuxcare.32.8.10-tuxcare.42.8.10-tuxcare.5
2.8.10-tuxcare.6
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.9.9.1 up to 2.9.9.1-tuxcare.5, plus listed versions
2.9.9.1-tuxcare.12.9.9.1-tuxcare.22.9.9.1-tuxcare.32.9.9.1-tuxcare.4
2.9.9.1-tuxcare.5
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 5 CVEs
 2.9.9.3 up to 2.9.9.3-tuxcare.5, plus listed versions
2.9.9.3-tuxcare.12.9.9.3-tuxcare.22.9.9.3-tuxcare.32.9.9.3-tuxcare.4
2.9.9.3-tuxcare.5
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
 2.6.3 up to 2.6.3-tuxcare.4, plus listed versions
2.6.3-tuxcare.12.6.3-tuxcare.22.6.3-tuxcare.3
2.6.3-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.7.9 up to 2.7.9-tuxcare.5, plus listed versions
2.7.9-tuxcare.12.7.9-tuxcare.22.7.9-tuxcare.32.7.9-tuxcare.4
2.7.9-tuxcare.5
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
 2.5.4 up to 2.5.4-tuxcare.4, plus listed versions
2.5.4-tuxcare.12.5.4-tuxcare.22.5.4-tuxcare.3
2.5.4-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
 2.9.10.4 up to 2.9.10.4-tuxcare.5, plus listed versions
2.9.10.4-tuxcare.12.9.10.4-tuxcare.22.9.10.4-tuxcare.32.9.10.4-tuxcare.4
2.9.10.4-tuxcare.5
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.6.6 up to 2.6.6-tuxcare.4, plus listed versions
2.6.6-tuxcare.12.6.6-tuxcare.22.6.6-tuxcare.3
2.6.6-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.1.4 up to 2.1.4-tuxcare.2, plus listed versions
2.1.4-tuxcare.1
2.1.4-tuxcare.2
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.2.3 up to 2.2.3-tuxcare.3, plus listed versions
2.2.3-tuxcare.12.2.3-tuxcare.2
2.2.3-tuxcare.3
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 11 CVEs
 2.8.11.1 up to 2.8.11.1-tuxcare.4, plus listed versions
2.8.11.1-tuxcare.12.8.11.1-tuxcare.22.8.11.1-tuxcare.3
2.8.11.1-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 4 CVEs
 2.18.2 up to 2.18.2-tuxcare.4, plus listed versions
2.18.2-tuxcare.12.18.2-tuxcare.22.18.2-tuxcare.3
2.18.2-tuxcare.4
com.fasterxml.jackson.core:jackson-databind
TuxCare:Maven
From an advisory covering 10 CVEs
 2.10.4 up to 2.10.4-tuxcare.4, plus listed versions
2.10.4-tuxcare.12.10.4-tuxcare.22.10.4-tuxcare.3
2.10.4-tuxcare.4
jackson-databind
Debian:12
 All versions, plus listed versions
2.14.0+ds-12.14.0+ds-22.14.0+ds-32.14.0-12.14.0-1+deb12u12.18.11-1
 None known
jackson-databind
Debian:13
 All versions, plus listed versions
2.14.0+ds-12.14.0+ds-1+deb13u12.14.0+ds-22.14.0+ds-32.18.11-1
 None known
jackson-databind
Debian:14
 before 2.18.11-1, plus listed versions
2.14.0+ds-12.14.0+ds-22.14.0+ds-3
2.18.11-1
tools.jackson.core:jackson-databind
Maven
 3.0.0 up to 3.1.6, plus listed versions
3.0.13.0.23.0.33.0.43.1.0
Show 6 moreShow less
3.1.0-rc13.1.13.1.23.1.33.1.43.1.5
3.1.6
tools.jackson.core:jackson-databind
Maven
 3.2.0 up to 3.2.2, plus listed versions
3.2.1
3.2.2
com.fasterxml.jackson.core:jackson-databind
Maven
 2.11.0 up to 2.18.10, plus listed versions
2.11.12.11.22.11.32.11.42.12.0
Show 45 moreShow less
2.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.6.12.12.72.12.7.12.12.7.22.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.2.12.13.2.22.13.32.13.42.13.4.12.13.4.22.13.52.14.02.14.0-rc12.14.0-rc22.14.0-rc32.14.12.14.22.14.32.15.02.15.0-rc12.15.0-rc22.15.0-rc32.15.12.15.22.15.32.15.42.16.02.16.0-rc12.16.12.16.22.17.02.17.0-rc1
2.18.10
com.fasterxml.jackson.core:jackson-databind
Maven
 2.19.0 up to 2.21.6, plus listed versions
2.19.12.19.22.19.32.19.42.20.0
Show 9 moreShow less
2.20.0-rc12.20.12.20.22.21.02.21.12.21.22.21.32.21.42.21.5
2.21.6
com.fasterxml.jackson.core:jackson-databind
Maven
 2.22.0 up to 2.22.2, plus listed versions
2.22.1
2.22.2
com.fasterxml.jackson.core:jackson-databind
Red Hat Lightwell:Maven
From an advisory covering 8 CVEs
 before 2.17.3.rhlw-00013, plus listed versions
2.0.02.0.0-RC12.0.0-RC22.0.0-RC32.0.1
Show 45 moreShow less
2.0.22.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.12.10.22.10.32.10.42.10.52.10.5.12.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.6.12.12.72.12.7.12.12.7.22.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.2.1
2.17.3.rhlw-00013
com.fasterxml.jackson.core:jackson-databind
Red Hat Lightwell:Maven
From an advisory covering 7 CVEs
 before 2.18.0.rhlw-00010, plus listed versions
2.0.02.0.0-RC12.0.0-RC22.0.0-RC32.0.1
Show 45 moreShow less
2.0.22.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.12.10.22.10.32.10.42.10.52.10.5.12.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.6.12.12.72.12.7.12.12.7.22.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.2.1
2.18.0.rhlw-00010
tools.jackson.core:jackson-databind
Root:Maven
 before 3.1.6-aikido.1
3.1.6-aikido.13.2.2-aikido.1
com.fasterxml.jackson.core:jackson-databind
Root:Maven
 before 2.18.10-aikido.1
2.18.10-aikido.12.21.6-aikido.12.22.2-aikido.1
io.root.tools.jackson.core:jackson-databind
Root:Maven
 before 3.1.6-root.io.1
3.1.6-root.io.13.2.2-root.io.1
io.root.com.fasterxml.jackson.core:jackson-databind
Root:Maven
 before 2.18.10-root.io.1
2.18.10-root.io.12.21.6-root.io.12.22.2-root.io.1
jackson-annotations
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-annotations
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-databind
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.2.2-12.2.2-1ubuntu0.1~esm1
 None known
jackson-databind
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.4.2-22.4.2-32.4.2-3ubuntu0.1~esm12.4.2-3ubuntu0.1~esm2
 None known
jackson-databind
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.8.6-12.9.1-12.9.4-12.9.5-12.9.8-1~18.04
 None known
jackson-databind
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.9.9.3-12.10.0-22.10.1-12.10.2-1
 None known
jackson-databind
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.12.1-12.12.5-12.13.0-12.13.0-2
 None known
jackson-databind
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.14.0-1
 None known
jackson-databind
Ubuntu:26.10
 All versions, plus listed versions
2.14.0+ds-1build12.14.0+ds-2
 None known
jackson-databind
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.14.0+ds-12.14.0+ds-1build1
 None known
jackson-databind
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 2.18.11-1.1
2.18.11-1.1
jackson-annotations
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1

History

History
RecordedChangedSources
affected, aliasesOSV
affected
affected, aliases, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-83557 is a medium vulnerability (CVSS 5.6) in Fasterxml Jackson-databind, published September 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in tools.jackson.core:jackson-databind 3.1.6.

References

Show 116 moreShow less
This page doesn't list everything

Left out here: 316 versions and the rest of 2 source descriptions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 41 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open