CVE-2026-91776
jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.
- Record
CVE-2026-91776- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-85002
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.
- Record
EUVD-2026-85002- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wv8q-qhhj-9h54
jackson-databind retains every unknown raw type ID
Summary
With @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unknown
raw type ID selects the same fallback deserializer but is retained as a
separate key in TypeDeserializerBase._deserializers. An attacker who can
repeatedly supply new unknown type IDs can grow this process-lifetime cache
without a configured bound.
Details
The affected path is TypeDeserializerBase._findDeserializer(). After an
unknown name-based type ID resolves to the configured fallback/default
implementation, jackson-databind caches the result under the attacker-provided
raw typeId. Although all such IDs select the same fallback deserializer, each
new string remains a distinct cache key.
The behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1.
Current 2.22 and 3.2 source branches retained the unbounded _deserializers
map and per-raw-ID cache write when rechecked. The earlier affected floor has
not been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.
The vulnerable application must enable name-based polymorphism with a
defaultImpl or equivalent fallback, accept attacker-influenced type IDs, and
reuse a long-lived mapper/type deserializer across requests.
Suggested correction: avoid caching each unknown raw ID when every such ID resolves to the same fallback, use a fallback sentinel, or use an explicitly bounded concurrency-safe cache. A regression should contrast many distinct unknown IDs with repetitions of one unknown ID across requests.
PoC
Configure a polymorphic base type with
@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class) and
deserialize inputs containing unknown type names through the same mapper.
Inspect TypeDeserializerBase._deserializers after the run.
On affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce 10,000 retained cache entries even though every input selects the same fallback deserializer. A matched control that repeats one unknown ID 10,000 times produces one retained entry. This isolates attacker-controlled key cardinality from ordinary request count.
Impact
Where the stated polymorphic fallback configuration is exposed to attacker-influenced type IDs, distinct inputs cause incremental process-lifetime memory retention and eventual availability pressure or denial of service. This is not claimed as a single-request allocation spike, and no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No confidentiality, integrity, or code-execution impact is claimed.
Requested credit: Daniel Birtwhistle
- Record
GHSA-wv8q-qhhj-9h54- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.
- Record
CVE-2026-91776- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.
- Record
CVE-2026-91776- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-91776
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.
- Record
DEBIAN-CVE-2026-91776- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 48 moreShow less
OSVGHSA-wv8q-qhhj-9h54
jackson-databind retains every unknown raw type ID
Summary
With @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unknown
raw type ID selects the same fallback deserializer but is retained as a
separate key in TypeDeserializerBase._deserializers. An attacker who can
repeatedly supply new unknown type IDs can grow this process-lifetime cache
without a configured bound.
Details
The affected path is TypeDeserializerBase._findDeserializer(). After an
unknown name-based type ID resolves to the configured fallback/default
implementation, jackson-databind caches the result under the attacker-provided
raw typeId. Although all such IDs select the same fallback deserializer, each
new string remains a distinct cache key.
The behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1.
Current 2.22 and 3.2 source branches retained the unbounded _deserializers
map and per-raw-ID cache write when rechecked. The earlier affected floor has
not been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.
The vulnerable application must enable name-based polymorphism with a
defaultImpl or equivalent fallback, accept attacker-influenced type IDs, and
reuse a long-lived mapper/type deserializer across requests.
Suggested correction: avoid caching each unknown raw ID when every such ID resolves to the same fallback, use a fallback sentinel, or use an explicitly bounded concurrency-safe cache. A regression should contrast many distinct unknown IDs with repetitions of one unknown ID across requests.
PoC
Configure a polymorphic base type with
@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class) and
deserialize inputs containing unknown type names through the same mapper.
Inspect TypeDeserializerBase._deserializers after the run.
On affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce 10,000 retained cache entries even though every input selects the same fallback deserializer. A matched control that repeats one unknown ID 10,000 times produces one retained entry. This isolates attacker-controlled key cardinality from ordinary request count.
Impact
Where the stated polymorphic fallback configuration is exposed to attacker-influenced type IDs, distinct inputs cause incremental process-lifetime memory retention and eventual availability pressure or denial of service. This is not claimed as a single-request allocation spike, and no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No confidentiality, integrity, or code-execution impact is claimed.
Requested credit: Daniel Birtwhistle
- Record
GHSA-wv8q-qhhj-9h54- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVRHLW-2026-bcaf0a0ae0978229
Lightwell Security Advisory: jackson-databind 2.13.4.2-rhlw-00004
Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.13.4.2-rhlw-00004 with a backported security fix.
CVE-2026-91776: jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.13.4.2 from Maven Central.
- Record
RHLW-2026-bcaf0a0ae0978229- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-91776
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.
- Record
UBUNTU-CVE-2026-91776- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1791487635 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.3-tuxcare.3.
- Record
CLSA-2026-1791487635- Updated
- 2026-11-02
OSVCLSA-2026-1792441729 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.21.4-tuxcare.1.
- Record
CLSA-2026-1792441729- Updated
- 2026-11-02
OSVCLSA-2026-1792441919 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.18.8-tuxcare.1.
- Record
CLSA-2026-1792441919- Updated
- 2026-11-02
OSVCLSA-2026-1792441992 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.17.2-tuxcare.2.
- Record
CLSA-2026-1792441992- Updated
- 2026-11-02
OSVCLSA-2026-1792479357 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.2-tuxcare.3.
- Record
CLSA-2026-1792479357- Updated
- 2026-11-02
OSVCLSA-2026-1793200513 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.7.8-tuxcare.2.
- Record
CLSA-2026-1793200513- Updated
- 2026-11-02
OSVCLSA-2026-1793200647 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.10.5.1-tuxcare.2.
- Record
CLSA-2026-1793200647- Updated
- 2026-11-02
OSVCLSA-2026-1793201235 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.21.2-tuxcare.1.
- Record
CLSA-2026-1793201235- Updated
- 2026-11-02
OSVCLSA-2026-1793207967 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.6.7.1-tuxcare.2.
- Record
CLSA-2026-1793207967- Updated
- 2026-11-06
OSVCLSA-2026-1793208072 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (31 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 31 CVEs. Fixed in 2.5.4-tuxcare.2.
- Record
CLSA-2026-1793208072- Updated
- 2026-11-06
OSVCLSA-2026-1793208167 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.6.3-tuxcare.2.
- Record
CLSA-2026-1793208167- Updated
- 2026-11-06
OSVCLSA-2026-1793208270 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.11.1-tuxcare.3.
- Record
CLSA-2026-1793208270- Updated
- 2026-11-02
OSVCLSA-2026-1793208638 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.5-tuxcare.2.
- Record
CLSA-2026-1793208638- Updated
- 2026-11-02
OSVCLSA-2026-1793208732 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.13.1-tuxcare.2.
- Record
CLSA-2026-1793208732- Updated
- 2026-11-02
OSVCLSA-2026-1793208938 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.1-tuxcare.3.
- Record
CLSA-2026-1793208938- Updated
- 2026-11-02
OSVCLSA-2026-1793209037 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.13.2.2-tuxcare.2.
- Record
CLSA-2026-1793209037- Updated
- 2026-11-02
OSVCLSA-2026-1793209495 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.11.0-tuxcare.2.
- Record
CLSA-2026-1793209495- Updated
- 2026-11-02
OSVCLSA-2026-1793209588 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.11.3-tuxcare.3.
- Record
CLSA-2026-1793209588- Updated
- 2026-11-02
OSVCLSA-2026-1793209672 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.6.6-tuxcare.2.
- Record
CLSA-2026-1793209672- Updated
- 2026-11-06
OSVCLSA-2026-1793209760 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.8.10-tuxcare.2.
- Record
CLSA-2026-1793209760- Updated
- 2026-11-02
OSVCLSA-2026-1793209895 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.13.4-tuxcare.2.
- Record
CLSA-2026-1793209895- Updated
- 2026-11-02
OSVCLSA-2026-1793214775 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.9.10.8-tuxcare.2.
- Record
CLSA-2026-1793214775- Updated
- 2026-11-02
OSVCLSA-2026-1793260179 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.11.4-tuxcare.2.
- Record
CLSA-2026-1793260179- Updated
- 2026-11-02
OSVCLSA-2026-1793260214 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.7.9.7-tuxcare.2.
- Record
CLSA-2026-1793260214- Updated
- 2026-11-02
OSVCLSA-2026-1793260230 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.10.2-tuxcare.2.
- Record
CLSA-2026-1793260230- Updated
- 2026-11-02
OSVCLSA-2026-1793260240 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.9.2-tuxcare.2.
- Record
CLSA-2026-1793260240- Updated
- 2026-11-02
OSVCLSA-2026-1793260371 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.10.3-tuxcare.2.
- Record
CLSA-2026-1793260371- Updated
- 2026-11-02
OSVCLSA-2026-1793273163 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.9.10-tuxcare.2.
- Record
CLSA-2026-1793273163- Updated
- 2026-11-02
OSVCLSA-2026-1793273322 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.9.8-tuxcare.2.
- Record
CLSA-2026-1793273322- Updated
- 2026-11-02
OSVCLSA-2026-1793273384 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.12.6.1-tuxcare.3.
- Record
CLSA-2026-1793273384- Updated
- 2026-11-02
OSVCLSA-2026-1793274003 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.9.1-tuxcare.2.
- Record
CLSA-2026-1793274003- Updated
- 2026-11-02
OSVCLSA-2026-1793274225 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.7-tuxcare.4.
- Record
CLSA-2026-1793274225- Updated
- 2026-11-02
OSVCLSA-2026-1793274468 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.12.6-tuxcare.2.
- Record
CLSA-2026-1793274468- Updated
- 2026-11-02
OSVCLSA-2026-1793274500 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.10.3-tuxcare.3.
- Record
CLSA-2026-1793274500- Updated
- 2026-11-02
OSVCLSA-2026-1793274960 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.7-tuxcare.3.
- Record
CLSA-2026-1793274960- Updated
- 2026-11-02
OSVCLSA-2026-1793287973 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.7.1-tuxcare.3.
- Record
CLSA-2026-1793287973- Updated
- 2026-11-02
OSVCLSA-2026-1793288062 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.4-tuxcare.3.
- Record
CLSA-2026-1793288062- Updated
- 2026-11-02
OSVCLSA-2026-1793288185 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.7.9-tuxcare.2.
- Record
CLSA-2026-1793288185- Updated
- 2026-11-02
OSVCLSA-2026-1793288285 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.5-tuxcare.3.
- Record
CLSA-2026-1793288285- Updated
- 2026-11-02
OSVCLSA-2026-1793288379 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.11.1-tuxcare.2.
- Record
CLSA-2026-1793288379- Updated
- 2026-11-02
OSVCLSA-2026-1793288485 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.7-tuxcare.2.
- Record
CLSA-2026-1793288485- Updated
- 2026-11-02
OSVCLSA-2026-1793288575 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.7.5-tuxcare.2.
- Record
CLSA-2026-1793288575- Updated
- 2026-11-06
OSVCLSA-2026-1793288673 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.3-tuxcare.3.
- Record
CLSA-2026-1793288673- Updated
- 2026-11-02
OSVCLSA-2026-1793294610 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.4.5-tuxcare.2.
- Record
CLSA-2026-1793294610- Updated
- 2026-11-06
OSVCLSA-2026-1793294643 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.11-tuxcare.2.
- Record
CLSA-2026-1793294643- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.fasterxml.jackson.core:jackson-databindMaven |
2.0.0 to 2.18.10 | 2.18.11 |
com.fasterxml.jackson.core:jackson-databindMaven |
2.19.0 to 2.21.6 | 2.21.7 |
com.fasterxml.jackson.core:jackson-databindMaven |
2.22.0 to 2.22.2 | 2.22.3 |
tools.jackson.core:jackson-databindMaven |
3.0.0 to 3.1.6 | 3.1.7 |
tools.jackson.core:jackson-databindMaven |
3.2.0 to 3.2.2 | 3.2.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 8 CVEs |
2.17.3 up to 2.17.3-tuxcare.3, plus listed versions 2.17.3-tuxcare.12.17.3-tuxcare.2 |
2.17.3-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.21.4 up to 2.21.4-tuxcare.1 | 2.21.4-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.18.8 up to 2.18.8-tuxcare.1 | 2.18.8-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs |
2.17.2 up to 2.17.2-tuxcare.2, plus listed versions 2.17.2-tuxcare.1 |
2.17.2-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.14.2 up to 2.14.2-tuxcare.3, plus listed versions 2.14.2-tuxcare.12.14.2-tuxcare.2 |
2.14.2-tuxcare.3 |
Show 182 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.7.8 up to 2.7.8-tuxcare.2, plus listed versions 2.7.8-tuxcare.1 |
2.7.8-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.10.5.1 up to 2.10.5.1-tuxcare.2, plus listed versions 2.10.5.1-tuxcare.1 |
2.10.5.1-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.21.2 up to 2.21.2-tuxcare.1 | 2.21.2-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 8 CVEs |
2.6.7.1 up to 2.6.7.1-tuxcare.2, plus listed versions 2.6.7.1-tuxcare.1 |
2.6.7.1-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 30 CVEs |
2.5.4 up to 2.5.4-tuxcare.2, plus listed versions 2.5.4-tuxcare.1 |
2.5.4-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.6.3 up to 2.6.3-tuxcare.2, plus listed versions 2.6.3-tuxcare.1 |
2.6.3-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.11.1 up to 2.11.1-tuxcare.3, plus listed versions 2.11.1-tuxcare.12.11.1-tuxcare.2 |
2.11.1-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.12.5 up to 2.12.5-tuxcare.2, plus listed versions 2.12.5-tuxcare.1 |
2.12.5-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.13.1 up to 2.13.1-tuxcare.2, plus listed versions 2.13.1-tuxcare.1 |
2.13.1-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.12.1 up to 2.12.1-tuxcare.3, plus listed versions 2.12.1-tuxcare.12.12.1-tuxcare.2 |
2.12.1-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.13.2.2 up to 2.13.2.2-tuxcare.2, plus listed versions 2.13.2.2-tuxcare.1 |
2.13.2.2-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.11.0 up to 2.11.0-tuxcare.2, plus listed versions 2.11.0-tuxcare.1 |
2.11.0-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.11.3 up to 2.11.3-tuxcare.3, plus listed versions 2.11.3-tuxcare.12.11.3-tuxcare.2 |
2.11.3-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.6.6 up to 2.6.6-tuxcare.2, plus listed versions 2.6.6-tuxcare.1 |
2.6.6-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.8.10 up to 2.8.10-tuxcare.2, plus listed versions 2.8.10-tuxcare.1 |
2.8.10-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.13.4 up to 2.13.4-tuxcare.2, plus listed versions 2.13.4-tuxcare.1 |
2.13.4-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs |
2.9.10.8 up to 2.9.10.8-tuxcare.2, plus listed versions 2.9.10.8-tuxcare.1 |
2.9.10.8-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs |
2.11.4 up to 2.11.4-tuxcare.2, plus listed versions 2.11.4-tuxcare.1 |
2.11.4-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.7.9.7 up to 2.7.9.7-tuxcare.2, plus listed versions 2.7.9.7-tuxcare.1 |
2.7.9.7-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.10.2 up to 2.10.2-tuxcare.2, plus listed versions 2.10.2-tuxcare.1 |
2.10.2-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs |
2.9.2 up to 2.9.2-tuxcare.2, plus listed versions 2.9.2-tuxcare.1 |
2.9.2-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.10.3 up to 2.10.3-tuxcare.2, plus listed versions 2.10.3-tuxcare.1 |
2.10.3-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 8 CVEs |
2.9.10 up to 2.9.10-tuxcare.2, plus listed versions 2.9.10-tuxcare.1 |
2.9.10-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.9.8 up to 2.9.8-tuxcare.2, plus listed versions 2.9.8-tuxcare.1 |
2.9.8-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.12.6.1 up to 2.12.6.1-tuxcare.3, plus listed versions 2.12.6.1-tuxcare.12.12.6.1-tuxcare.2 |
2.12.6.1-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.9.9.1 up to 2.9.9.1-tuxcare.2, plus listed versions 2.9.9.1-tuxcare.1 |
2.9.9.1-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.8.7 up to 2.8.7-tuxcare.4, plus listed versions 2.8.7-tuxcare.12.8.7-tuxcare.22.8.7-tuxcare.3 |
2.8.7-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 10 CVEs |
2.12.6 up to 2.12.6-tuxcare.2, plus listed versions 2.12.6-tuxcare.1 |
2.12.6-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.9.10.3 up to 2.9.10.3-tuxcare.3, plus listed versions 2.9.10.3-tuxcare.12.9.10.3-tuxcare.2 |
2.9.10.3-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.12.7 up to 2.12.7-tuxcare.3, plus listed versions 2.12.7-tuxcare.12.12.7-tuxcare.2 |
2.12.7-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.7.1 up to 2.7.1-tuxcare.3, plus listed versions 2.7.1-tuxcare.12.7.1-tuxcare.2 |
2.7.1-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.8.4 up to 2.8.4-tuxcare.3, plus listed versions 2.8.4-tuxcare.12.8.4-tuxcare.2 |
2.8.4-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.8.5 up to 2.8.5-tuxcare.3, plus listed versions 2.8.5-tuxcare.12.8.5-tuxcare.2 |
2.8.5-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.8.11.1 up to 2.8.11.1-tuxcare.2, plus listed versions 2.8.11.1-tuxcare.1 |
2.8.11.1-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.9.7 up to 2.9.7-tuxcare.2, plus listed versions 2.9.7-tuxcare.1 |
2.9.7-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.7.5 up to 2.7.5-tuxcare.2, plus listed versions 2.7.5-tuxcare.1 |
2.7.5-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.9.3 up to 2.9.3-tuxcare.3, plus listed versions 2.9.3-tuxcare.12.9.3-tuxcare.2 |
2.9.3-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 12 CVEs |
2.4.5 up to 2.4.5-tuxcare.2, plus listed versions 2.4.5-tuxcare.1 |
2.4.5-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.8.11 up to 2.8.11-tuxcare.2, plus listed versions 2.8.11-tuxcare.1 |
2.8.11-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 12 CVEs |
2.4.1 up to 2.4.1-tuxcare.2, plus listed versions 2.4.1-tuxcare.1 |
2.4.1-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.6.7.3 up to 2.6.7.3-tuxcare.3, plus listed versions 2.6.7.3-tuxcare.12.6.7.3-tuxcare.2 |
2.6.7.3-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 11 CVEs |
2.4.3 up to 2.4.3-tuxcare.2, plus listed versions 2.4.3-tuxcare.1 |
2.4.3-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.6.7.2 up to 2.6.7.2-tuxcare.3, plus listed versions 2.6.7.2-tuxcare.12.6.7.2-tuxcare.2 |
2.6.7.2-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.9.4 up to 2.9.4-tuxcare.2, plus listed versions 2.9.4-tuxcare.1 |
2.9.4-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.13.0 up to 2.13.0-tuxcare.3, plus listed versions 2.13.0-tuxcare.12.13.0-tuxcare.2 |
2.13.0-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs |
2.15.2 up to 2.15.2-tuxcare.3, plus listed versions 2.15.2-tuxcare.12.15.2-tuxcare.2 |
2.15.2-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs |
2.19.0 up to 2.19.0-tuxcare.2, plus listed versions 2.19.0-tuxcare.1 |
2.19.0-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs |
2.15.3 up to 2.15.3-tuxcare.3, plus listed versions 2.15.3-tuxcare.12.15.3-tuxcare.2 |
2.15.3-tuxcare.3 |
tools.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
3.1.2 up to 3.1.2-tuxcare.1 | 3.1.2-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs |
2.20.1 up to 2.20.1-tuxcare.3, plus listed versions 2.20.1-tuxcare.12.20.1-tuxcare.2 |
2.20.1-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.12.4 up to 2.12.4-tuxcare.3, plus listed versions 2.12.4-tuxcare.12.12.4-tuxcare.2 |
2.12.4-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs |
2.16.1 up to 2.16.1-tuxcare.2, plus listed versions 2.16.1-tuxcare.1 |
2.16.1-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.10.4 up to 2.10.4-tuxcare.3, plus listed versions 2.10.4-tuxcare.12.10.4-tuxcare.2 |
2.10.4-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.9.10.7 up to 2.9.10.7-tuxcare.3, plus listed versions 2.9.10.7-tuxcare.12.9.10.7-tuxcare.2 |
2.9.10.7-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.18.4 up to 2.18.4-tuxcare.3, plus listed versions 2.18.4-tuxcare.12.18.4-tuxcare.2 |
2.18.4-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs |
2.16.2 up to 2.16.2-tuxcare.3, plus listed versions 2.16.2-tuxcare.12.16.2-tuxcare.2 |
2.16.2-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.15.1 up to 2.15.1-tuxcare.3, plus listed versions 2.15.1-tuxcare.12.15.1-tuxcare.2 |
2.15.1-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.15.0 up to 2.15.0-tuxcare.2, plus listed versions 2.15.0-tuxcare.1 |
2.15.0-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.15.4 up to 2.15.4-tuxcare.4, plus listed versions 2.15.4-tuxcare.12.15.4-tuxcare.22.15.4-tuxcare.3 |
2.15.4-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs |
2.18.5 up to 2.18.5-tuxcare.3, plus listed versions 2.18.5-tuxcare.12.18.5-tuxcare.2 |
2.18.5-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 11 CVEs |
2.9.10.4 up to 2.9.10.4-tuxcare.3, plus listed versions 2.9.10.4-tuxcare.12.9.10.4-tuxcare.2 |
2.9.10.4-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 14 CVEs |
2.8.11.3 up to 2.8.11.3-tuxcare.2, plus listed versions 2.8.11.3-tuxcare.1 |
2.8.11.3-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 12 CVEs |
2.9.1 up to 2.9.1-tuxcare.2, plus listed versions 2.9.1-tuxcare.1 |
2.9.1-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 10 CVEs |
2.7.9.3 up to 2.7.9.3-tuxcare.3, plus listed versions 2.7.9.3-tuxcare.12.7.9.3-tuxcare.2 |
2.7.9.3-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 13 CVEs |
2.9.9 up to 2.9.9-tuxcare.2, plus listed versions 2.9.9-tuxcare.1 |
2.9.9-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 16 CVEs |
2.9.9.3 up to 2.9.9.3-tuxcare.2, plus listed versions 2.9.9.3-tuxcare.1 |
2.9.9.3-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 13 CVEs |
2.8.11.4 up to 2.8.11.4-tuxcare.2, plus listed versions 2.8.11.4-tuxcare.1 |
2.8.11.4-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 19 CVEs |
2.9.5 up to 2.9.5-tuxcare.2, plus listed versions 2.9.5-tuxcare.1 |
2.9.5-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 8 CVEs |
2.6.4 up to 2.6.4-tuxcare.2, plus listed versions 2.6.4-tuxcare.1 |
2.6.4-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 11 CVEs |
2.7.3 up to 2.7.3-tuxcare.3, plus listed versions 2.7.3-tuxcare.12.7.3-tuxcare.2 |
2.7.3-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.18.0 up to 2.18.0-tuxcare.3, plus listed versions 2.18.0-tuxcare.12.18.0-tuxcare.2 |
2.18.0-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 14 CVEs |
2.9.10.1 up to 2.9.10.1-tuxcare.2, plus listed versions 2.9.10.1-tuxcare.1 |
2.9.10.1-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.18.2 up to 2.18.2-tuxcare.2, plus listed versions 2.18.2-tuxcare.1 |
2.18.2-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 10 CVEs |
2.12.2 up to 2.12.2-tuxcare.3, plus listed versions 2.12.2-tuxcare.12.12.2-tuxcare.2 |
2.12.2-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.6.5 up to 2.6.5-tuxcare.3, plus listed versions 2.6.5-tuxcare.12.6.5-tuxcare.2 |
2.6.5-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.4.1.1 up to 2.4.1.1-tuxcare.3, plus listed versions 2.4.1.1-tuxcare.12.4.1.1-tuxcare.2 |
2.4.1.1-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.16.0 up to 2.16.0-tuxcare.4, plus listed versions 2.16.0-tuxcare.12.16.0-tuxcare.22.16.0-tuxcare.3 |
2.16.0-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.17.0 up to 2.17.0-tuxcare.2, plus listed versions 2.17.0-tuxcare.1 |
2.17.0-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.13.4.2 up to 2.13.4.2-tuxcare.3, plus listed versions 2.13.4.2-tuxcare.12.13.4.2-tuxcare.2 |
2.13.4.2-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.19.4 up to 2.19.4-tuxcare.2, plus listed versions 2.19.4-tuxcare.1 |
2.19.4-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.13.5 up to 2.13.5-tuxcare.3, plus listed versions 2.13.5-tuxcare.12.13.5-tuxcare.2 |
2.13.5-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.17.1 up to 2.17.1-tuxcare.4, plus listed versions 2.17.1-tuxcare.12.17.1-tuxcare.22.17.1-tuxcare.3 |
2.17.1-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.19.2 up to 2.19.2-tuxcare.2, plus listed versions 2.19.2-tuxcare.1 |
2.19.2-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.14.1 up to 2.14.1-tuxcare.3, plus listed versions 2.14.1-tuxcare.12.14.1-tuxcare.2 |
2.14.1-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 10 CVEs |
2.9.10.6 up to 2.9.10.6-tuxcare.2, plus listed versions 2.9.10.6-tuxcare.1 |
2.9.10.6-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.4.0 up to 2.4.0-tuxcare.3, plus listed versions 2.4.0-tuxcare.12.4.0-tuxcare.2 |
2.4.0-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 8 CVEs |
2.7.0 up to 2.7.0-tuxcare.3, plus listed versions 2.7.0-tuxcare.12.7.0-tuxcare.2 |
2.7.0-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.12.7.1 up to 2.12.7.1-tuxcare.4, plus listed versions 2.12.7.1-tuxcare.12.12.7.1-tuxcare.22.12.7.1-tuxcare.3 |
2.12.7.1-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.13.3 up to 2.13.3-tuxcare.2, plus listed versions 2.13.3-tuxcare.1 |
2.13.3-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.11.2 up to 2.11.2-tuxcare.2, plus listed versions 2.11.2-tuxcare.1 |
2.11.2-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.9.10.5 up to 2.9.10.5-tuxcare.2, plus listed versions 2.9.10.5-tuxcare.1 |
2.9.10.5-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.14.3 up to 2.14.3-tuxcare.2, plus listed versions 2.14.3-tuxcare.1 |
2.14.3-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.18.3 up to 2.18.3-tuxcare.5, plus listed versions 2.18.3-tuxcare.12.18.3-tuxcare.22.18.3-tuxcare.32.18.3-tuxcare.4 |
2.18.3-tuxcare.5 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.1.4 up to 2.1.4-tuxcare.2, plus listed versions 2.1.4-tuxcare.1 |
2.1.4-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 4 CVEs |
2.2.3 up to 2.2.3-tuxcare.3, plus listed versions 2.2.3-tuxcare.12.2.3-tuxcare.2 |
2.2.3-tuxcare.3 |
jackson-databindDebian:12 |
All versions, plus listed versions 2.14.0+ds-12.14.0+ds-22.14.0+ds-32.14.0-12.14.0-1+deb12u12.18.11-1 |
None known |
jackson-databindDebian:13 |
All versions, plus listed versions 2.14.0+ds-12.14.0+ds-1+deb13u12.14.0+ds-22.14.0+ds-32.18.11-1 |
None known |
jackson-databindDebian:14 |
before 2.18.11-1, plus listed versions 2.14.0+ds-12.14.0+ds-22.14.0+ds-3 |
2.18.11-1 |
com.fasterxml.jackson.core:jackson-databindMaven |
2.0.0 up to 2.18.11, plus listed versions 2.0.12.0.22.0.42.0.52.0.6 Show 45 moreShow less2.1.02.1.12.1.22.1.32.1.42.1.52.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.12.10.22.10.32.10.42.10.52.10.5.12.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.6.12.12.72.12.7.12.12.7.22.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.2.12.13.2.22.13.32.13.42.13.4.1 |
2.18.11 |
com.fasterxml.jackson.core:jackson-databindMaven |
2.19.0 up to 2.21.7, plus listed versions 2.19.12.19.22.19.32.19.42.20.0 Show 10 moreShow less2.20.0-rc12.20.12.20.22.21.02.21.12.21.22.21.32.21.42.21.52.21.6 |
2.21.7 |
com.fasterxml.jackson.core:jackson-databindMaven |
2.22.0 up to 2.22.3, plus listed versions 2.22.12.22.2 |
2.22.3 |
tools.jackson.core:jackson-databindMaven |
3.0.0 up to 3.1.7, plus listed versions 3.0.13.0.23.0.33.0.43.1.0 Show 7 moreShow less3.1.0-rc13.1.13.1.23.1.33.1.43.1.53.1.6 |
3.1.7 |
tools.jackson.core:jackson-databindMaven |
3.2.0 up to 3.2.3, plus listed versions 3.2.13.2.2 |
3.2.3 |
com.fasterxml.jackson.core:jackson-databindRed Hat Lightwell:Maven |
before 2.13.4.2-rhlw-00004, plus listed versions 2.0.02.0.0-RC12.0.0-RC22.0.0-RC32.0.1 Show 45 moreShow less2.0.22.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.12.10.22.10.32.10.42.10.52.10.5.12.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.6.12.12.72.12.7.12.12.7.22.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.2.1 |
2.13.4.2-rhlw-00004 |
com.fasterxml.jackson.core:jackson-databindRoot:Maven |
before 2.18.9-aikido.1 | 2.18.9-aikido.12.18.9-aikido.22.21.5-aikido.32.13.3-aikido.72.12.7.1-aikido.32.21.4-aikido.22.14.2-aikido.42.22.1-aikido.12.21.1-aikido.42.13.4.2-aikido.32.12.6.1-aikido.22.12.7-aikido.22.13.2.2-aikido.52.18.1-aikido.42.17.2-aikido.62.16.0-aikido.32.17.1-aikido.32.19.1-aikido.22.21.2-aikido.42.19.4-aikido.52.21.3-aikido.32.20.0-aikido.42.18.10-aikido.12.15.2-aikido.42.21.6-aikido.12.19.0-aikido.22.15.0-aikido.42.16.2-aikido.62.18.8-aikido.22.18.2-aikido.42.22.2-aikido.12.22.1-aikido.22.19.0-aikido.32.18.3-aikido.52.21.2-aikido.52.19.1-aikido.32.22.0-aikido.12.13.5-aikido.2 |
tools.jackson.core:jackson-databindRoot:Maven |
before 3.1.5-aikido.3 | 3.1.5-aikido.33.1.4-aikido.23.1.6-aikido.13.1.4-aikido.33.1.5-aikido.43.1.4-aikido.43.2.2-aikido.1 |
io.root.com.fasterxml.jackson.core:jackson-databindRoot:Maven |
before 2.18.9-root.io.1 | 2.18.9-root.io.12.18.9-root.io.22.21.5-root.io.32.13.3-root.io.72.12.7.1-root.io.32.21.4-root.io.22.14.2-root.io.42.22.1-root.io.12.21.1-root.io.42.13.4.2-root.io.32.12.6.1-root.io.22.12.7-root.io.22.13.2.2-root.io.52.18.1-root.io.42.17.2-root.io.62.16.0-root.io.32.17.1-root.io.32.19.1-root.io.22.21.2-root.io.42.19.4-root.io.52.21.3-root.io.32.20.0-root.io.42.18.10-root.io.12.15.2-root.io.42.21.6-root.io.12.19.0-root.io.22.15.0-root.io.42.16.2-root.io.62.18.8-root.io.22.18.2-root.io.42.22.2-root.io.12.22.1-root.io.22.19.0-root.io.32.18.3-root.io.52.21.2-root.io.52.19.1-root.io.32.22.0-root.io.12.13.5-root.io.2 |
io.root.tools.jackson.core:jackson-databindRoot:Maven |
before 3.1.5-root.io.3 | 3.1.5-root.io.33.1.4-root.io.23.1.6-root.io.13.1.4-root.io.33.1.5-root.io.43.1.4-root.io.43.2.2-root.io.1 |
jackson-annotationsSUSE:Linux Enterprise Server 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-coreSUSE:Linux Enterprise Server 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-databindSUSE:Linux Enterprise Server 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-annotationsSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-coreSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-databindSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-annotationsSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-annotationsSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.28.1 | 2.18.11-150200.3.28.1 |
jackson-coreSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.30.1 | 2.18.11-150200.3.30.1 |
jackson-databindSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.36.1 | 2.18.11-150200.3.36.1 |
jackson-dataformat-xmlSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 12 CVEs |
before 2.18.11-150200.5.8.1 | 2.18.11-150200.5.8.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 12 CVEs |
before 2.18.11-150200.3.29.1 | 2.18.11-150200.3.29.1 |
jackson-databindUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.2.2-12.2.2-1ubuntu0.1~esm1 |
None known |
jackson-databindUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.4.2-22.4.2-32.4.2-3ubuntu0.1~esm12.4.2-3ubuntu0.1~esm2 |
None known |
jackson-databindUbuntu:18.04:LTS |
All versions, plus listed versions 2.8.6-12.9.1-12.9.4-12.9.5-12.9.8-1~18.04 |
None known |
jackson-databindUbuntu:20.04:LTS |
All versions, plus listed versions 2.9.9.3-12.10.0-22.10.1-12.10.2-1 |
None known |
jackson-databindUbuntu:22.04:LTS |
All versions, plus listed versions 2.12.1-12.12.5-12.13.0-12.13.0-2 |
None known |
jackson-databindUbuntu:24.04:LTS |
All versions, plus listed versions 2.14.0-1 |
None known |
jackson-databindUbuntu:26.10 |
All versions, plus listed versions 2.14.0+ds-1build12.14.0+ds-2 |
None known |
jackson-databindUbuntu:26.04:LTS |
All versions, plus listed versions 2.14.0+ds-12.14.0+ds-1build1 |
None known |
jackson-databindopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 2.18.11-1.1 | 2.18.11-1.1 |
jackson-annotationsopenSUSE:Leap 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-coreopenSUSE:Leap 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
jackson-databindopenSUSE:Leap 16.0 From an advisory covering 10 CVEs |
before 2.18.11-160000.1.1 | 2.18.11-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases_more | OSV | |
| affected | ||
| affected, aliases_more, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-91776 is a high vulnerability (CVSS 7.5) in Fasterxml Jackson-databind, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in com.fasterxml.jackson.core:jackson-databind 2.18.11.
References
github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54
nvd.nist.gov/vuln/detail/CVE-2026-91776
Show 37 moreShow less
repo1.maven.org/maven2
security-tracker.debian.org/tracker/CVE-2026-91776
suse.com/support/update/announcement/2026/suse-su-202624149-1
bugzilla.suse.com/1273856
ubuntu.com/security/CVE-2026-91776
cve.org/CVERecord?id=CVE-2026-91776
Left out here: 283 versions. The JSON record has them. Also not on the record: 12 aliases. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 61 source records.