Every CVE Search/ Get API key

CVE-2026-89425

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

7.5 HighFix available

UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.53%Unchanged since Sep 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Record
CVE-2026-89425
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770, CWE-400
Updated
2026-11-02
EUVDEUVD-2026-85000 7.5

UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Record
EUVD-2026-85000
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-7hhh-6rmp-j9qf 7.5

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Status

FULLY REPRODUCED. A malformed token fed through createParser(DataInput) produced a 20,000,109-character exception message from a 20-million-character attacker payload, while the identical payload fed through createParser(InputStream) produced a correctly bounded 367-character message.

Affected Component / Version

  • Package: com.fasterxml.jackson.core:jackson-core
  • Confirmed against: jackson-core-2.20.2
  • Affected file: src/main/java/com/fasterxml/jackson/core/json/UTF8DataInputJsonParser.java (_reportInvalidToken(int, String, String), lines ~2763-2780 in the 2.20.2 tree)

Technical Analysis

UTF8DataInputJsonParser._reportInvalidToken() builds the offending-token description for its exception message by appending identifier characters one at a time to a bare StringBuilder:

protected void _reportInvalidToken(int ch, String matchedPart, String msg) throws IOException {
    StringBuilder sb = new StringBuilder(matchedPart);
    while (true) {
        char c = (char) _decodeCharForError(ch);
        if (!Character.isJavaIdentifierPart(c)) {
            break;
        }
        sb.append(c);
        ch = _inputData.readUnsignedByte();
    }
    _reportError("Unrecognized token '"+sb.toString()+"': was expecting "+msg);
}

There is no check against ErrorReportConfiguration.getMaxErrorTokenLength() (default 256) anywhere in this loop. By contrast, the sibling UTF8StreamJsonParser implementation of the same logic does enforce it:

// UTF8StreamJsonParser.java (control, correctly bounded)
if (sb.length() >= _ioContext.errorReportConfiguration().getMaxErrorTokenLength()) {
    sb.append("...");
    break;
}

ReaderBasedJsonParser and NonBlockingUtf8JsonParserBase also correctly enforce the limit — this is a defect isolated to the DataInput-backed implementation specifically, confirmed by direct comparison of all four parser implementations in this tree.

This path is additionally left with no fallback control: because of [core#1570]-related logic in JsonFactory, configuring maxDocumentLength causes DataInput-sourced parser creation to be rejected outright, so a document-length backstop cannot coexist with this input source, and the identifier-character accumulation never passes through ReadConstrainedTextBuffer, so maxStringLength does not apply either. There is no configuration an application can set to mitigate this specific path.

Reproduction Procedure

Same clone/build steps as jackson-core_1_...md. Then:

CP="build/classes:build/lib/fastdoubleparser-2.0.1.jar"
javac -cp "$CP" -d poc poc/PoC6_UnboundedErrorTokenStringBuilder.java
java -Xmx2g -cp "poc:$CP" PoC6_UnboundedErrorTokenStringBuilder

Full PoC Source (poc/PoC6_UnboundedErrorTokenStringBuilder.java)

import com.fasterxml.jackson.core.*;

import java.io.DataInputStream;
import java.io.IOException;
import java.io.InputStream;

public class PoC6_UnboundedErrorTokenStringBuilder {

    static class RepeatingByteInputStream extends InputStream {
        private final int b;
        private long remaining;
        RepeatingByteInputStream(int b, long count) { this.b = b; this.remaining = count; }
        @Override public int read() {
            if (remaining <= 0) return -1;
            remaining--;
            return b;
        }
    }

    public static void main(String[] args) throws Exception {
        final long IDENTIFIER_CHAR_COUNT = 20_000_000L;

        System.out.println("Malformed token: \"t\" followed by " + IDENTIFIER_CHAR_COUNT
                + " Java-identifier characters ('x'), then a terminating space, never completing"
                + " \"true\"/\"false\"/\"null\"/NaN.\n");

        System.out.println("=== (a) UTF8DataInputJsonParser via createParser(DataInput) ===");
        {
            InputStream raw = concat3("{\"a\": t".getBytes("UTF-8"),
                    new RepeatingByteInputStream('x',…
Record
GHSA-7hhh-6rmp-j9qf
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
NVD 7.5

UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Record
CVE-2026-89425
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSV 7.5

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Record
CVE-2026-89425
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-05
OSVDEBIAN-CVE-2026-89425 7.5

UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Record
DEBIAN-CVE-2026-89425
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 48 moreShow less
OSVGHSA-7hhh-6rmp-j9qf 7.5

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Status

FULLY REPRODUCED. A malformed token fed through createParser(DataInput) produced a 20,000,109-character exception message from a 20-million-character attacker payload, while the identical payload fed through createParser(InputStream) produced a correctly bounded 367-character message.

Affected Component / Version

  • Package: com.fasterxml.jackson.core:jackson-core
  • Confirmed against: jackson-core-2.20.2
  • Affected file: src/main/java/com/fasterxml/jackson/core/json/UTF8DataInputJsonParser.java (_reportInvalidToken(int, String, String), lines ~2763-2780 in the 2.20.2 tree)

Technical Analysis

UTF8DataInputJsonParser._reportInvalidToken() builds the offending-token description for its exception message by appending identifier characters one at a time to a bare StringBuilder:

protected void _reportInvalidToken(int ch, String matchedPart, String msg) throws IOException {
    StringBuilder sb = new StringBuilder(matchedPart);
    while (true) {
        char c = (char) _decodeCharForError(ch);
        if (!Character.isJavaIdentifierPart(c)) {
            break;
        }
        sb.append(c);
        ch = _inputData.readUnsignedByte();
    }
    _reportError("Unrecognized token '"+sb.toString()+"': was expecting "+msg);
}

There is no check against ErrorReportConfiguration.getMaxErrorTokenLength() (default 256) anywhere in this loop. By contrast, the sibling UTF8StreamJsonParser implementation of the same logic does enforce it:

// UTF8StreamJsonParser.java (control, correctly bounded)
if (sb.length() >= _ioContext.errorReportConfiguration().getMaxErrorTokenLength()) {
    sb.append("...");
    break;
}

ReaderBasedJsonParser and NonBlockingUtf8JsonParserBase also correctly enforce the limit — this is a defect isolated to the DataInput-backed implementation specifically, confirmed by direct comparison of all four parser implementations in this tree.

This path is additionally left with no fallback control: because of [core#1570]-related logic in JsonFactory, configuring maxDocumentLength causes DataInput-sourced parser creation to be rejected outright, so a document-length backstop cannot coexist with this input source, and the identifier-character accumulation never passes through ReadConstrainedTextBuffer, so maxStringLength does not apply either. There is no configuration an application can set to mitigate this specific path.

Reproduction Procedure

Same clone/build steps as jackson-core_1_...md. Then:

CP="build/classes:build/lib/fastdoubleparser-2.0.1.jar"
javac -cp "$CP" -d poc poc/PoC6_UnboundedErrorTokenStringBuilder.java
java -Xmx2g -cp "poc:$CP" PoC6_UnboundedErrorTokenStringBuilder

Full PoC Source (poc/PoC6_UnboundedErrorTokenStringBuilder.java)

import com.fasterxml.jackson.core.*;

import java.io.DataInputStream;
import java.io.IOException;
import java.io.InputStream;

public class PoC6_UnboundedErrorTokenStringBuilder {

    static class RepeatingByteInputStream extends InputStream {
        private final int b;
        private long remaining;
        RepeatingByteInputStream(int b, long count) { this.b = b; this.remaining = count; }
        @Override public int read() {
            if (remaining <= 0) return -1;
            remaining--;
            return b;
        }
    }

    public static void main(String[] args) throws Exception {
        final long IDENTIFIER_CHAR_COUNT = 20_000_000L;

        System.out.println("Malformed token: \"t\" followed by " + IDENTIFIER_CHAR_COUNT
                + " Java-identifier characters ('x'), then a terminating space, never completing"
                + " \"true\"/\"false\"/\"null\"/NaN.\n");

        System.out.println("=== (a) UTF8DataInputJsonParser via createParser(DataInput) ===");
        {
            InputStream raw = concat3("{\"a\": t".getBytes("UTF-8"),
                    new RepeatingByteInputStream('x',…
Record
GHSA-7hhh-6rmp-j9qf
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVRLSA-2026:86706 7.5

Moderate: jackson-core security update

Core part of Jackson that defines Streaming API as well as basic shared abstractions.

Security Fix(es):

  • com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)

  • com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:86706
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:90909 7.5

Important: pki-deps:10.6 security update

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.

Security Fix(es):

  • com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)

  • com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)

  • com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:90909
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-89425 7.5

UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class.

Record
UBUNTU-CVE-2026-89425
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:86706 No score

Moderate: jackson-core security update

Core part of Jackson that defines Streaming API as well as basic shared abstractions.

Security Fix(es):

  • com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)
  • com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86706
Updated
2026-11-02
OSVALSA-2026:90909 No score

Important: pki-deps:10.6 security update

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

Security Fix(es):

  • com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)
  • com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)
  • com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:90909
Updated
2026-11-02
OSVCLSA-2026-1791485698 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.17.1-tuxcare.1.

Record
CLSA-2026-1791485698
Updated
2026-11-02
OSVCLSA-2026-1791485784 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (4 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 4 CVEs. Fixed in 2.17.3-tuxcare.2.

Record
CLSA-2026-1791485784
Updated
2026-11-02
OSVCLSA-2026-1791486041 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.17.2-tuxcare.2.

Record
CLSA-2026-1791486041
Updated
2026-11-02
OSVCLSA-2026-1791493683 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.14.2-tuxcare.3.

Record
CLSA-2026-1791493683
Updated
2026-11-02
OSVCLSA-2026-1791495450 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.14.1-tuxcare.2.

Record
CLSA-2026-1791495450
Updated
2026-11-02
OSVCLSA-2026-1792399331 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.6.7-tuxcare.1.

Record
CLSA-2026-1792399331
Updated
2026-11-02
OSVCLSA-2026-1792399344 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.9.8-tuxcare.1.

Record
CLSA-2026-1792399344
Updated
2026-11-02
OSVCLSA-2026-1792399348 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.9.9-tuxcare.1.

Record
CLSA-2026-1792399348
Updated
2026-11-02
OSVCLSA-2026-1792399384 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.15.4-tuxcare.1.

Record
CLSA-2026-1792399384
Updated
2026-11-02
OSVCLSA-2026-1792399394 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.2.3-tuxcare.1.

Record
CLSA-2026-1792399394
Updated
2026-11-02
OSVCLSA-2026-1792399424 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.9.10-tuxcare.1.

Record
CLSA-2026-1792399424
Updated
2026-11-02
OSVCLSA-2026-1792399436 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.15.2-tuxcare.1.

Record
CLSA-2026-1792399436
Updated
2026-11-02
OSVCLSA-2026-1792399442 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.14.3-tuxcare.1.

Record
CLSA-2026-1792399442
Updated
2026-11-02
OSVCLSA-2026-1792399460 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.13.2-tuxcare.1.

Record
CLSA-2026-1792399460
Updated
2026-11-02
OSVCLSA-2026-1792399472 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.13.4-tuxcare.1.

Record
CLSA-2026-1792399472
Updated
2026-11-02
OSVCLSA-2026-1792416889 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.1.3-tuxcare.1.

Record
CLSA-2026-1792416889
Updated
2026-11-02
OSVCLSA-2026-1792427235 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.6.0-tuxcare.1.

Record
CLSA-2026-1792427235
Updated
2026-11-02
OSVCLSA-2026-1792427260 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.7.0-tuxcare.1.

Record
CLSA-2026-1792427260
Updated
2026-11-02
OSVCLSA-2026-1792428179 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.7.9-tuxcare.1.

Record
CLSA-2026-1792428179
Updated
2026-11-02
OSVCLSA-2026-1792428196 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.7.4-tuxcare.1.

Record
CLSA-2026-1792428196
Updated
2026-11-02
OSVCLSA-2026-1792428198 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.7.8-tuxcare.1.

Record
CLSA-2026-1792428198
Updated
2026-11-02
OSVCLSA-2026-1792428221 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.8.8-tuxcare.1.

Record
CLSA-2026-1792428221
Updated
2026-11-02
OSVCLSA-2026-1792428247 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.8.11-tuxcare.1.

Record
CLSA-2026-1792428247
Updated
2026-11-02
OSVCLSA-2026-1792428307 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.9.6-tuxcare.1.

Record
CLSA-2026-1792428307
Updated
2026-11-02
OSVCLSA-2026-1792428320 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.15.3-tuxcare.1.

Record
CLSA-2026-1792428320
Updated
2026-11-02
OSVCLSA-2026-1792428388 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.10.4-tuxcare.1.

Record
CLSA-2026-1792428388
Updated
2026-11-02
OSVCLSA-2026-1792428396 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.10.0-tuxcare.1.

Record
CLSA-2026-1792428396
Updated
2026-11-02
OSVCLSA-2026-1792428438 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.11.3-tuxcare.1.

Record
CLSA-2026-1792428438
Updated
2026-11-02
OSVCLSA-2026-1792428490 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.12.6-tuxcare.1.

Record
CLSA-2026-1792428490
Updated
2026-11-02
OSVCLSA-2026-1792428529 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.12.7-tuxcare.1.

Record
CLSA-2026-1792428529
Updated
2026-11-02
OSVCLSA-2026-1792428696 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.21.4-tuxcare.1.

Record
CLSA-2026-1792428696
Updated
2026-11-02
OSVCLSA-2026-1792428707 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.10.5-tuxcare.1.

Record
CLSA-2026-1792428707
Updated
2026-11-02
OSVCLSA-2026-1792428711 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.11.1-tuxcare.1.

Record
CLSA-2026-1792428711
Updated
2026-11-02
OSVCLSA-2026-1792428725 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.11.4-tuxcare.1.

Record
CLSA-2026-1792428725
Updated
2026-11-02
OSVCLSA-2026-1792428797 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.12.2-tuxcare.1.

Record
CLSA-2026-1792428797
Updated
2026-11-02
OSVCLSA-2026-1792428805 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.11.2-tuxcare.1.

Record
CLSA-2026-1792428805
Updated
2026-11-02
OSVCLSA-2026-1792431620 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.16.1-tuxcare.1.

Record
CLSA-2026-1792431620
Updated
2026-11-02
OSVCLSA-2026-1792431625 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.12.1-tuxcare.2.

Record
CLSA-2026-1792431625
Updated
2026-11-02
OSVCLSA-2026-1792431627 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.15.0-tuxcare.1.

Record
CLSA-2026-1792431627
Updated
2026-11-02
OSVCLSA-2026-1792434304 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (4 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 4 CVEs. Fixed in 2.13.3-tuxcare.1.

Record
CLSA-2026-1792434304
Updated
2026-11-02
OSVCLSA-2026-1792434736 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.4.0-tuxcare.1.

Record
CLSA-2026-1792434736
Updated
2026-11-02
OSVCLSA-2026-1792437356 No score

TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.13.5-tuxcare.1.

Record
CLSA-2026-1792437356
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
com.fasterxml.jackson.core:jackson-core
Maven
 2.19.0 to 2.21.6
2.21.7
com.fasterxml.jackson.core:jackson-core
Maven
 2.22.0 to 2.22.2
2.22.3
tools.jackson.core:jackson-core
Maven
 3.0.0 to 3.1.6
3.1.7
tools.jackson.core:jackson-core
Maven
 3.2.0 to 3.2.2
3.2.3
com.fasterxml.jackson.core:jackson-core
Maven
 2.8.0 to 2.18.10
2.18.11
pki-jackson-core
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.21.6-1.el9_8.2
2.21.6-1.el9_8.2
apache-commons-collections
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3.2.2-10.module_el8.5.0+2577+9e95fe00
3.2.2-10.module_el8.5.0+2577+9e95fe00
apache-commons-lang
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.6-21.module_el8.5.0+2577+9e95fe00
2.6-21.module_el8.5.0+2577+9e95fe00
apache-commons-net
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3.6-3.module_el8.5.0+2577+9e95fe00
3.6-3.module_el8.5.0+2577+9e95fe00
bea-stax-api
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.2.0-16.module_el8.5.0+2577+9e95fe00
1.2.0-16.module_el8.5.0+2577+9e95fe00
Show 225 moreShow less
Affected packages
PackageAffectedFixed
glassfish-fastinfoset
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.2.13-9.module_el8.5.0+2577+9e95fe00
1.2.13-9.module_el8.5.0+2577+9e95fe00
glassfish-jaxb-api
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.2.12-8.module_el8.5.0+2577+9e95fe00
2.2.12-8.module_el8.5.0+2577+9e95fe00
glassfish-jaxb-core
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.2.11-12.module_el8.10.0+3791+e0637953
2.2.11-12.module_el8.10.0+3791+e0637953
glassfish-jaxb-runtime
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.2.11-12.module_el8.10.0+3791+e0637953
2.2.11-12.module_el8.10.0+3791+e0637953
glassfish-jaxb-txw2
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.2.11-12.module_el8.10.0+3791+e0637953
2.2.11-12.module_el8.10.0+3791+e0637953
jackson-annotations
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.21-1.module_el8.10.0+4235+0924958e
2.21-1.module_el8.10.0+4235+0924958e
jackson-core
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.21.4-1.module_el8.10.0+4329+908ad137.3
2.21.4-1.module_el8.10.0+4329+908ad137.3
jackson-databind
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.21.4-1.module_el8.10.0+4329+908ad137.1
2.21.4-1.module_el8.10.0+4329+908ad137.1
jackson-jaxrs-json-provider
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.21.4-1.module_el8.10.0+4235+0924958e
2.21.4-1.module_el8.10.0+4235+0924958e
jackson-jaxrs-providers
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.21.4-1.module_el8.10.0+4235+0924958e
2.21.4-1.module_el8.10.0+4235+0924958e
jackson-module-jaxb-annotations
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.21.4-2.module_el8.10.0+4235+0924958e
2.21.4-2.module_el8.10.0+4235+0924958e
jakarta-commons-httpclient
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:3.1-28.module_el8.5.0+2577+9e95fe00
1:3.1-28.module_el8.5.0+2577+9e95fe00
javassist
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3.18.1-8.module_el8.5.0+2577+9e95fe00
3.18.1-8.module_el8.5.0+2577+9e95fe00
javassist-javadoc
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3.18.1-8.module_el8.5.0+2577+9e95fe00
3.18.1-8.module_el8.5.0+2577+9e95fe00
pki-servlet-engine
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:9.0.62-1.module_el8.10.0+3791+e0637953
1:9.0.62-1.module_el8.10.0+3791+e0637953
relaxngDatatype
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2011.1-7.module_el8.5.0+2577+9e95fe00
2011.1-7.module_el8.5.0+2577+9e95fe00
slf4j
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.7.25-4.module_el8.5.0+2577+9e95fe00
1.7.25-4.module_el8.5.0+2577+9e95fe00
slf4j-jdk14
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.7.25-4.module_el8.5.0+2577+9e95fe00
1.7.25-4.module_el8.5.0+2577+9e95fe00
stax-ex
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.7.7-8.module_el8.5.0+2577+9e95fe00
1.7.7-8.module_el8.5.0+2577+9e95fe00
velocity
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.7-24.module_el8.5.0+2577+9e95fe00
1.7-24.module_el8.5.0+2577+9e95fe00
xalan-j2
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.7.1-38.module_el8.5.0+2577+9e95fe00
2.7.1-38.module_el8.5.0+2577+9e95fe00
xerces-j2
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.11.0-34.module_el8.5.0+2577+9e95fe00
2.11.0-34.module_el8.5.0+2577+9e95fe00
xml-commons-apis
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.4.01-25.module_el8.5.0+2577+9e95fe00
1.4.01-25.module_el8.5.0+2577+9e95fe00
xml-commons-resolver
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.2-26.module_el8.5.0+2577+9e95fe00
1.2-26.module_el8.5.0+2577+9e95fe00
xmlstreambuffer
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.5.4-8.module_el8.5.0+2577+9e95fe00
1.5.4-8.module_el8.5.0+2577+9e95fe00
xsom
AlmaLinux:8
From an advisory covering 3 CVEs
 before 0-19.20110809svn.module_el8.5.0+2577+9e95fe00
0-19.20110809svn.module_el8.5.0+2577+9e95fe00
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 4 CVEs
 2.17.1 up to 2.17.1-tuxcare.1
2.17.1-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 3 CVEs
 2.17.3 up to 2.17.3-tuxcare.2, plus listed versions
2.17.3-tuxcare.1
2.17.3-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.17.2 up to 2.17.2-tuxcare.2, plus listed versions
2.17.2-tuxcare.1
2.17.2-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.14.2 up to 2.14.2-tuxcare.3, plus listed versions
2.14.2-tuxcare.12.14.2-tuxcare.2
2.14.2-tuxcare.3
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.14.1 up to 2.14.1-tuxcare.2, plus listed versions
2.14.1-tuxcare.1
2.14.1-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.6.7 up to 2.6.7-tuxcare.1
2.6.7-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.9.8 up to 2.9.8-tuxcare.1
2.9.8-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.9.9 up to 2.9.9-tuxcare.1
2.9.9-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.15.4 up to 2.15.4-tuxcare.1
2.15.4-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.2.3 up to 2.2.3-tuxcare.1
2.2.3-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.9.10 up to 2.9.10-tuxcare.1
2.9.10-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.15.2 up to 2.15.2-tuxcare.1
2.15.2-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.14.3 up to 2.14.3-tuxcare.1
2.14.3-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 3 CVEs
 2.13.2 up to 2.13.2-tuxcare.1
2.13.2-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 3 CVEs
 2.13.4 up to 2.13.4-tuxcare.1
2.13.4-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.1.3 up to 2.1.3-tuxcare.1
2.1.3-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.6.0 up to 2.6.0-tuxcare.1
2.6.0-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.7.0 up to 2.7.0-tuxcare.1
2.7.0-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.7.9 up to 2.7.9-tuxcare.1
2.7.9-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.7.4 up to 2.7.4-tuxcare.1
2.7.4-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.7.8 up to 2.7.8-tuxcare.1
2.7.8-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.8.8 up to 2.8.8-tuxcare.1
2.8.8-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.8.11 up to 2.8.11-tuxcare.1
2.8.11-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.9.6 up to 2.9.6-tuxcare.1
2.9.6-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.15.3 up to 2.15.3-tuxcare.1
2.15.3-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.10.4 up to 2.10.4-tuxcare.1
2.10.4-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.10.0 up to 2.10.0-tuxcare.1
2.10.0-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.11.3 up to 2.11.3-tuxcare.1
2.11.3-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.12.6 up to 2.12.6-tuxcare.1
2.12.6-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.12.7 up to 2.12.7-tuxcare.1
2.12.7-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.21.4 up to 2.21.4-tuxcare.1
2.21.4-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.10.5 up to 2.10.5-tuxcare.1
2.10.5-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.11.1 up to 2.11.1-tuxcare.1
2.11.1-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.11.4 up to 2.11.4-tuxcare.1
2.11.4-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.12.2 up to 2.12.2-tuxcare.1
2.12.2-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.11.2 up to 2.11.2-tuxcare.1
2.11.2-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.16.1 up to 2.16.1-tuxcare.1
2.16.1-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.12.1 up to 2.12.1-tuxcare.2, plus listed versions
2.12.1-tuxcare.1
2.12.1-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 3 CVEs
 2.15.0 up to 2.15.0-tuxcare.1
2.15.0-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.13.3 up to 2.13.3-tuxcare.1
2.13.3-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.4.0 up to 2.4.0-tuxcare.1
2.4.0-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.13.5 up to 2.13.5-tuxcare.1
2.13.5-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.18.4.1 up to 2.18.4.1-tuxcare.2, plus listed versions
2.18.4.1-tuxcare.1
2.18.4.1-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 4 CVEs
 2.20.1 up to 2.20.1-tuxcare.1
2.20.1-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.18.1 up to 2.18.1-tuxcare.1
2.18.1-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.18.3 up to 2.18.3-tuxcare.2, plus listed versions
2.18.3-tuxcare.1
2.18.3-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.18.5 up to 2.18.5-tuxcare.2, plus listed versions
2.18.5-tuxcare.1
2.18.5-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.18.0 up to 2.18.0-tuxcare.2, plus listed versions
2.18.0-tuxcare.1
2.18.0-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.12.3 up to 2.12.3-tuxcare.1
2.12.3-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.9.3 up to 2.9.3-tuxcare.1
2.9.3-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.8.7 up to 2.8.7-tuxcare.1
2.8.7-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.18.8 up to 2.18.8-tuxcare.2, plus listed versions
2.18.8-tuxcare.1
2.18.8-tuxcare.2
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
 2.21.2 up to 2.21.2-tuxcare.1
2.21.2-tuxcare.1
com.fasterxml.jackson.core:jackson-core
TuxCare:Maven
From an advisory covering 2 CVEs
 2.19.4 up to 2.19.4-tuxcare.1
2.19.4-tuxcare.1
jackson-core
Debian:12
 All versions, plus listed versions
2.14.1-12.14.1-22.14.1-2~deb11u12.14.1-2~deb12u12.14.1-2~deb13u12.18.11-1
 None known
jackson-core
Debian:13
 All versions, plus listed versions
2.14.1-12.14.1-22.14.1-2~deb11u12.14.1-2~deb12u12.14.1-2~deb13u12.18.11-1
 None known
jackson-core
Debian:14
 before 2.18.11-1, plus listed versions
2.14.1-12.14.1-22.14.1-2~deb11u12.14.1-2~deb12u12.14.1-2~deb13u1
2.18.11-1
com.fasterxml.jackson.core:jackson-core
Maven
 2.19.0 up to 2.21.7, plus listed versions
2.19.12.19.22.19.32.19.42.20.0
Show 10 moreShow less
2.20.0-rc12.20.12.20.22.21.02.21.12.21.22.21.32.21.42.21.52.21.6
2.21.7
com.fasterxml.jackson.core:jackson-core
Maven
 2.22.0 up to 2.22.3, plus listed versions
2.22.12.22.2
2.22.3
tools.jackson.core:jackson-core
Maven
 3.0.0 up to 3.1.7, plus listed versions
3.0.13.0.23.0.33.0.43.1.0
Show 7 moreShow less
3.1.0-rc13.1.13.1.23.1.33.1.43.1.53.1.6
3.1.7
tools.jackson.core:jackson-core
Maven
 3.2.0 up to 3.2.3, plus listed versions
3.2.13.2.2
3.2.3
com.fasterxml.jackson.core:jackson-core
Maven
 2.8.0 up to 2.18.11, plus listed versions
2.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.1
Show 45 moreShow less
2.10.22.10.32.10.42.10.52.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.72.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.32.13.42.13.52.14.02.14.0-rc12.14.0-rc22.14.0-rc32.14.12.14.22.14.32.15.02.15.0-rc12.15.0-rc22.15.0-rc32.15.12.15.22.15.32.15.42.16.02.16.0-rc1
2.18.11
jackson-core
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2.21.6-1.el9_8.2
0:2.21.6-1.el9_8.2
apache-commons-collections
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.2.2-10.module+el8.10.0+1763+c7c02164
0:3.2.2-10.module+el8.10.0+1763+c7c02164
apache-commons-collections
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.2.2-10.module+el8.10.0+2052+1b0fb438
0:3.2.2-10.module+el8.10.0+2052+1b0fb438
apache-commons-collections
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.2.2-10.module+el8.3.0+74+855e3f5d
0:3.2.2-10.module+el8.3.0+74+855e3f5d
apache-commons-lang
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.6-21.module+el8.10.0+1763+c7c02164
0:2.6-21.module+el8.10.0+1763+c7c02164
apache-commons-lang
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.6-21.module+el8.3.0+74+855e3f5d
0:2.6-21.module+el8.3.0+74+855e3f5d
apache-commons-net
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.6-3.module+el8.10.0+1763+c7c02164
0:3.6-3.module+el8.10.0+1763+c7c02164
apache-commons-net
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.6-3.module+el8.10.0+2052+1b0fb438
0:3.6-3.module+el8.10.0+2052+1b0fb438
apache-commons-net
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.6-3.module+el8.3.0+74+855e3f5d
0:3.6-3.module+el8.3.0+74+855e3f5d
bea-stax
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2.0-16.module+el8.10.0+1763+c7c02164
0:1.2.0-16.module+el8.10.0+1763+c7c02164
bea-stax
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2.0-16.module+el8.10.0+2052+1b0fb438
0:1.2.0-16.module+el8.10.0+2052+1b0fb438
glassfish-fastinfoset
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2.13-9.module+el8.10.0+1763+c7c02164
0:1.2.13-9.module+el8.10.0+1763+c7c02164
glassfish-fastinfoset
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2.13-9.module+el8.10.0+2052+1b0fb438
0:1.2.13-9.module+el8.10.0+2052+1b0fb438
glassfish-jaxb
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.2.11-12.module+el8.10.0+1763+c7c02164
0:2.2.11-12.module+el8.10.0+1763+c7c02164
glassfish-jaxb
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.2.11-12.module+el8.10.0+2052+1b0fb438
0:2.2.11-12.module+el8.10.0+2052+1b0fb438
glassfish-jaxb-api
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.2.12-8.module+el8.10.0+1763+c7c02164
0:2.2.12-8.module+el8.10.0+1763+c7c02164
glassfish-jaxb-api
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.2.12-8.module+el8.10.0+2052+1b0fb438
0:2.2.12-8.module+el8.10.0+2052+1b0fb438
jackson-annotations
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21-1.module+el8.10.0+40260+021059e6
0:2.21-1.module+el8.10.0+40260+021059e6
jackson-core
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21.4-1.module+el8.10.0+40260+021059e6
0:2.21.4-1.module+el8.10.0+40260+021059e6
jackson-core
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.3
0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.3
jackson-databind
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.1
0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.1
jackson-databind
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21.4-1.module+el8.10.0+40260+021059e6
0:2.21.4-1.module+el8.10.0+40260+021059e6
jackson-jaxrs-providers
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21.4-1.module+el8.10.0+40260+021059e6
0:2.21.4-1.module+el8.10.0+40260+021059e6
jackson-modules-base
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.21.4-2.module+el8.10.0+40260+021059e6
0:2.21.4-2.module+el8.10.0+40260+021059e6
jakarta-commons-httpclient
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:3.1-28.module+el8.10.0+1763+c7c02164
1:3.1-28.module+el8.10.0+1763+c7c02164
jakarta-commons-httpclient
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:3.1-28.module+el8.10.0+2052+1b0fb438
1:3.1-28.module+el8.10.0+2052+1b0fb438
jakarta-commons-httpclient
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:3.1-28.module+el8.3.0+74+855e3f5d
1:3.1-28.module+el8.3.0+74+855e3f5d
javassist
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.18.1-8.module+el8.10.0+1763+c7c02164
0:3.18.1-8.module+el8.10.0+1763+c7c02164
javassist
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.18.1-8.module+el8.10.0+2052+1b0fb438
0:3.18.1-8.module+el8.10.0+2052+1b0fb438
javassist
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.18.1-8.module+el8.3.0+74+855e3f5d
0:3.18.1-8.module+el8.3.0+74+855e3f5d
pki-servlet-engine
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:9.0.62-1.module+el8.10.0+1767+f923f786
1:9.0.62-1.module+el8.10.0+1767+f923f786
pki-servlet-engine
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:9.0.62-1.module+el8.10.0+2052+1b0fb438
1:9.0.62-1.module+el8.10.0+2052+1b0fb438
relaxngDatatype
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2011.1-7.module+el8.10.0+1763+c7c02164
0:2011.1-7.module+el8.10.0+1763+c7c02164
relaxngDatatype
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2011.1-7.module+el8.10.0+2052+1b0fb438
0:2011.1-7.module+el8.10.0+2052+1b0fb438
slf4j
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.25-4.module+el8.10.0+1763+c7c02164
0:1.7.25-4.module+el8.10.0+1763+c7c02164
slf4j
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.25-4.module+el8.10.0+2052+1b0fb438
0:1.7.25-4.module+el8.10.0+2052+1b0fb438
slf4j
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.25-4.module+el8.6.0+843+5a13dac3
0:1.7.25-4.module+el8.6.0+843+5a13dac3
slf4j
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.25-4.module+el8.3.0+74+855e3f5d
0:1.7.25-4.module+el8.3.0+74+855e3f5d
slf4j
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.25-4.module+el8.10.0+2003+8aeac9cb
0:1.7.25-4.module+el8.10.0+2003+8aeac9cb
stax-ex
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.7-8.module+el8.10.0+1763+c7c02164
0:1.7.7-8.module+el8.10.0+1763+c7c02164
stax-ex
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7.7-8.module+el8.10.0+2052+1b0fb438
0:1.7.7-8.module+el8.10.0+2052+1b0fb438
velocity
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7-24.module+el8.10.0+1763+c7c02164
0:1.7-24.module+el8.10.0+1763+c7c02164
velocity
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7-24.module+el8.10.0+2052+1b0fb438
0:1.7-24.module+el8.10.0+2052+1b0fb438
velocity
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.7-24.module+el8.3.0+74+855e3f5d
0:1.7-24.module+el8.3.0+74+855e3f5d
xalan-j2
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.7.1-38.module+el8.10.0+1763+c7c02164
0:2.7.1-38.module+el8.10.0+1763+c7c02164
xalan-j2
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.7.1-38.module+el8.10.0+2052+1b0fb438
0:2.7.1-38.module+el8.10.0+2052+1b0fb438
xalan-j2
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.7.1-38.module+el8.3.0+74+855e3f5d
0:2.7.1-38.module+el8.3.0+74+855e3f5d
xerces-j2
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.11.0-34.module+el8.10.0+1763+c7c02164
0:2.11.0-34.module+el8.10.0+1763+c7c02164
xerces-j2
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.11.0-34.module+el8.10.0+2052+1b0fb438
0:2.11.0-34.module+el8.10.0+2052+1b0fb438
xerces-j2
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.11.0-34.module+el8.3.0+74+855e3f5d
0:2.11.0-34.module+el8.3.0+74+855e3f5d
xml-commons-apis
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.4.01-25.module+el8.10.0+1763+c7c02164
0:1.4.01-25.module+el8.10.0+1763+c7c02164
xml-commons-apis
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.4.01-25.module+el8.10.0+2052+1b0fb438
0:1.4.01-25.module+el8.10.0+2052+1b0fb438
xml-commons-apis
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.4.01-25.module+el8.10.0+2003+8aeac9cb
0:1.4.01-25.module+el8.10.0+2003+8aeac9cb
xml-commons-apis
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.4.01-25.module+el8.3.0+74+855e3f5d
0:1.4.01-25.module+el8.3.0+74+855e3f5d
xml-commons-resolver
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2-26.module+el8.10.0+2052+1b0fb438
0:1.2-26.module+el8.10.0+2052+1b0fb438
xml-commons-resolver
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2-26.module+el8.10.0+1763+c7c02164
0:1.2-26.module+el8.10.0+1763+c7c02164
xml-commons-resolver
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.2-26.module+el8.3.0+74+855e3f5d
0:1.2-26.module+el8.3.0+74+855e3f5d
xmlstreambuffer
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.5.4-8.module+el8.10.0+1763+c7c02164
0:1.5.4-8.module+el8.10.0+1763+c7c02164
xmlstreambuffer
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.5.4-8.module+el8.10.0+2052+1b0fb438
0:1.5.4-8.module+el8.10.0+2052+1b0fb438
xsom
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:0-19.20110809svn.module+el8.10.0+1763+c7c02164
0:0-19.20110809svn.module+el8.10.0+1763+c7c02164
xsom
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:0-19.20110809svn.module+el8.10.0+2052+1b0fb438
0:0-19.20110809svn.module+el8.10.0+2052+1b0fb438
com.fasterxml.jackson.core:jackson-core
Root:Maven
 before 2.21.3-aikido.2
2.21.3-aikido.22.17.2-aikido.42.21.4-aikido.12.18.10-aikido.12.18.9-aikido.12.18.8-aikido.12.21.5-aikido.12.21.2-aikido.22.14.2-aikido.42.15.2-aikido.32.17.1-aikido.32.13.0-aikido.22.12.7-aikido.52.21.2-aikido.32.21.6-aikido.12.22.1-aikido.12.12.7-aikido.62.22.2-aikido.12.12.7-aikido.72.17.2-aikido.52.13.5-aikido.22.18.3-aikido.3
tools.jackson.core:jackson-core
Root:Maven
 before 3.1.6-aikido.1
3.1.6-aikido.13.1.4-aikido.13.1.5-aikido.13.2.2-aikido.1
io.root.com.fasterxml.jackson.core:jackson-core
Root:Maven
 before 2.21.3-root.io.2
2.21.3-root.io.22.17.2-root.io.42.21.4-root.io.12.18.10-root.io.12.18.9-root.io.12.18.8-root.io.12.21.5-root.io.12.21.2-root.io.22.14.2-root.io.42.15.2-root.io.32.17.1-root.io.32.13.0-root.io.22.12.7-root.io.52.21.2-root.io.32.21.6-root.io.12.22.1-root.io.12.12.7-root.io.62.22.2-root.io.12.12.7-root.io.72.17.2-root.io.52.13.5-root.io.22.18.3-root.io.3
io.root.tools.jackson.core:jackson-core
Root:Maven
 before 3.1.6-root.io.1
3.1.6-root.io.13.1.4-root.io.13.1.5-root.io.13.2.2-root.io.1
jackson-annotations
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-annotations
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-annotations
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.28.1
2.18.11-150200.3.28.1
jackson-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.30.1
2.18.11-150200.3.30.1
jackson-databind
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.36.1
2.18.11-150200.3.36.1
jackson-dataformat-xml
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.5.8.1
2.18.11-150200.5.8.1
jackson-dataformats-binary
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 12 CVEs
 before 2.18.11-150200.3.29.1
2.18.11-150200.3.29.1
jackson-core
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.4.2-2
 None known
jackson-core
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.8.6-12.9.1-12.9.4-12.9.8-3~18.04
 None known
jackson-core
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.9.8-32.10.0-12.10.1-1
 None known
jackson-core
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.12.1-12.13.0-12.13.0-2
 None known
jackson-core
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.14.1-1
 None known
jackson-core
Ubuntu:26.10
 All versions, plus listed versions
2.14.1-1build12.14.1-2
 None known
jackson-core
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.14.1-12.14.1-1build1
 None known
jackson-core
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 2.18.11-1.1
2.18.11-1.1
jackson-annotations
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-core
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1
jackson-databind
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 2.18.11-160000.1.1
2.18.11-160000.1.1

History

History
RecordedChangedSources
affectedOSV
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-89425 is a high vulnerability (CVSS 7.5) in Fasterxml Jackson-core, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in com.fasterxml.jackson.core:jackson-core 2.21.7.

References

Show 51 moreShow less
This page doesn't list everything

Left out here: 46 versions and the rest of 2 source descriptions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 17 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open