{"id":"CVE-2020-10650","aliases":["CLSA-2026-1793208072","CLSA-2026-1793866911","CLSA-2026-1793867014","CLSA-2026-1793867520","CLSA-2026-1793867639","CLSA-2026-1793868698","CLSA-2026-1793869897","CLSA-2026-1793870384","CLSA-2026-1793870822","CLSA-2026-1793957557","CLSA-2026-1793957775","CLSA-2026-1794221834","CLSA-2026-1794222386","CLSA-2026-1794223928","CLSA-2026-1794223990","CLSA-2026-1794224575","CLSA-2026-1794224690","CLSA-2026-1794225369","CLSA-2026-1794225652","CLSA-2026-1794226057","CLSA-2026-1794226417","CLSA-2026-1794226556","CLSA-2026-1794229690","CLSA-2026-1794232556","CLSA-2026-1794232852","CLSA-2026-1794303155","CLSA-2026-1794303249","CLSA-2026-1794304579","CLSA-2026-1794305366","CLSA-2026-1794306626","CLSA-2026-1794330953","CLSA-2026-1794331020","DEBIAN-CVE-2020-10650","DLA-3407-1","EUVD-2022-6411","GHSA-rpr3-cw39-3pxh","OESA-2021-1129","ROOT-APP-MAVEN-CVE-2020-10650","UBUNTU-CVE-2020-10650"],"status":"published","title":"jackson-databind vulnerable to unsafe deserialization","description":"A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.036,"percentile":0.89605,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2021-04-07T11:04:22Z","modified":"2026-11-11T01:30:02Z","fixes":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.9.10.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"jackson-databind","fixed_in":["2.11.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jackson-databind","fixed_in":["2.11.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jackson-databind","fixed_in":["2.11.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"jackson-databind","fixed_in":["2.9.8-3+deb10u5"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"subversion","fixed_in":["1.12.2-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"subversion","fixed_in":["1.12.2-3.oe1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.3.1-aikido.5","2.3.1-aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.5.2-root.io.1","2.5.2-root.io.2","2.3.1-root.io.5","2.3.1-root.io.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.9.10.3"},{"fixed":"2.9.10.4"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.4"},{"fixed":"2.5.4-tuxcare.2"}]}],"versions":["2.5.4","2.5.4-tuxcare.1"],"bundled":30},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.2"},{"fixed":"2.10.2-tuxcare.4"}]}],"versions":["2.10.2","2.10.2-tuxcare.1","2.10.2-tuxcare.2","2.10.2-tuxcare.3"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1-tuxcare.3"}]}],"versions":["2.9.1","2.9.1-tuxcare.1","2.9.1-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.2"},{"fixed":"2.9.2-tuxcare.4"}]}],"versions":["2.9.2","2.9.2-tuxcare.1","2.9.2-tuxcare.2","2.9.2-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.3"},{"fixed":"2.9.3-tuxcare.6"}]}],"versions":["2.9.3","2.9.3-tuxcare.1","2.9.3-tuxcare.2","2.9.3-tuxcare.3","2.9.3-tuxcare.4","2.9.3-tuxcare.5"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.3"},{"fixed":"2.9.10.3-tuxcare.6"}]}],"versions":["2.9.10.3","2.9.10.3-tuxcare.1","2.9.10.3-tuxcare.2","2.9.10.3-tuxcare.3","2.9.10.3-tuxcare.4","2.9.10.3-tuxcare.5"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10"},{"fixed":"2.9.10-tuxcare.5"}]}],"versions":["2.9.10","2.9.10-tuxcare.1","2.9.10-tuxcare.2","2.9.10-tuxcare.3","2.9.10-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9.1"},{"fixed":"2.9.9.1-tuxcare.5"}]}],"versions":["2.9.9.1","2.9.9.1-tuxcare.1","2.9.9.1-tuxcare.2","2.9.9.1-tuxcare.3","2.9.9.1-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9.3"},{"fixed":"2.9.9.3-tuxcare.5"}]}],"versions":["2.9.9.3","2.9.9.3-tuxcare.1","2.9.9.3-tuxcare.2","2.9.9.3-tuxcare.3","2.9.9.3-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.5"},{"fixed":"2.7.5-tuxcare.6"}]}],"versions":["2.7.5","2.7.5-tuxcare.1","2.7.5-tuxcare.2","2.7.5-tuxcare.3","2.7.5-tuxcare.4","2.7.5-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11"},{"fixed":"2.8.11-tuxcare.6"}]}],"versions":["2.8.11","2.8.11-tuxcare.1","2.8.11-tuxcare.2","2.8.11-tuxcare.3","2.8.11-tuxcare.4","2.8.11-tuxcare.5"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.8"},{"fixed":"2.9.8-tuxcare.5"}]}],"versions":["2.9.8","2.9.8-tuxcare.1","2.9.8-tuxcare.2","2.9.8-tuxcare.3","2.9.8-tuxcare.4"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.4"},{"fixed":"2.8.11.4-tuxcare.5"}]}],"versions":["2.8.11.4","2.8.11.4-tuxcare.1","2.8.11.4-tuxcare.2","2.8.11.4-tuxcare.3","2.8.11.4-tuxcare.4"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.5"},{"fixed":"2.9.5-tuxcare.5"}]}],"versions":["2.9.5","2.9.5-tuxcare.1","2.9.5-tuxcare.2","2.9.5-tuxcare.3","2.9.5-tuxcare.4"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.3"},{"fixed":"2.8.11.3-tuxcare.5"}]}],"versions":["2.8.11.3","2.8.11.3-tuxcare.1","2.8.11.3-tuxcare.2","2.8.11.3-tuxcare.3","2.8.11.3-tuxcare.4"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9"},{"fixed":"2.9.9-tuxcare.4"}]}],"versions":["2.9.9","2.9.9-tuxcare.1","2.9.9-tuxcare.2","2.9.9-tuxcare.3"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.4"},{"fixed":"2.8.4-tuxcare.7"}]}],"versions":["2.8.4","2.8.4-tuxcare.1","2.8.4-tuxcare.2","2.8.4-tuxcare.3","2.8.4-tuxcare.4","2.8.4-tuxcare.5","2.8.4-tuxcare.6"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.7"},{"fixed":"2.9.7-tuxcare.5"}]}],"versions":["2.9.7","2.9.7-tuxcare.1","2.9.7-tuxcare.2","2.9.7-tuxcare.3","2.9.7-tuxcare.4"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.4"},{"fixed":"2.9.4-tuxcare.6"}]}],"versions":["2.9.4","2.9.4-tuxcare.1","2.9.4-tuxcare.2","2.9.4-tuxcare.3","2.9.4-tuxcare.4","2.9.4-tuxcare.5"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.6"}]}],"versions":["2.7.9","2.7.9-tuxcare.1","2.7.9-tuxcare.2","2.7.9-tuxcare.3","2.7.9-tuxcare.4","2.7.9-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7.2"},{"fixed":"2.6.7.2-tuxcare.4"}]}],"versions":["2.6.7.2","2.6.7.2-tuxcare.1","2.6.7.2-tuxcare.2","2.6.7.2-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.5"},{"fixed":"2.6.5-tuxcare.4"}]}],"versions":["2.6.5","2.6.5-tuxcare.1","2.6.5-tuxcare.2","2.6.5-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.0-tuxcare.5"}]}],"versions":["2.7.0","2.7.0-tuxcare.1","2.7.0-tuxcare.2","2.7.0-tuxcare.3","2.7.0-tuxcare.4"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9.7"},{"fixed":"2.7.9.7-tuxcare.6"}]}],"versions":["2.7.9.7","2.7.9.7-tuxcare.1","2.7.9.7-tuxcare.2","2.7.9.7-tuxcare.3","2.7.9.7-tuxcare.4","2.7.9.7-tuxcare.5"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7.1"},{"fixed":"2.6.7.1-tuxcare.4"}]}],"versions":["2.6.7.1","2.6.7.1-tuxcare.1","2.6.7.1-tuxcare.2","2.6.7.1-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9.3"},{"fixed":"2.7.9.3-tuxcare.6"}]}],"versions":["2.7.9.3","2.7.9.3-tuxcare.1","2.7.9.3-tuxcare.2","2.7.9.3-tuxcare.3","2.7.9.3-tuxcare.4","2.7.9.3-tuxcare.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.8"},{"fixed":"2.7.8-tuxcare.6"}]}],"versions":["2.7.8","2.7.8-tuxcare.1","2.7.8-tuxcare.2","2.7.8-tuxcare.3","2.7.8-tuxcare.4","2.7.8-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.10"},{"fixed":"2.8.10-tuxcare.8"}]}],"versions":["2.8.10","2.8.10-tuxcare.1","2.8.10-tuxcare.2","2.8.10-tuxcare.3","2.8.10-tuxcare.4","2.8.10-tuxcare.5","2.8.10-tuxcare.6","2.8.10-tuxcare.7"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3"},{"fixed":"2.10.3-tuxcare.6"}]}],"versions":["2.10.3","2.10.3-tuxcare.1","2.10.3-tuxcare.2","2.10.3-tuxcare.3","2.10.3-tuxcare.4","2.10.3-tuxcare.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.1"},{"fixed":"2.8.11.1-tuxcare.6"}]}],"versions":["2.8.11.1","2.8.11.1-tuxcare.1","2.8.11.1-tuxcare.2","2.8.11.1-tuxcare.3","2.8.11.1-tuxcare.4","2.8.11.1-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1"},{"fixed":"2.7.1-tuxcare.7"}]}],"versions":["2.7.1","2.7.1-tuxcare.1","2.7.1-tuxcare.2","2.7.1-tuxcare.3","2.7.1-tuxcare.4","2.7.1-tuxcare.5","2.7.1-tuxcare.6"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.3"},{"fixed":"2.7.3-tuxcare.6"}]}],"versions":["2.7.3","2.7.3-tuxcare.1","2.7.3-tuxcare.2","2.7.3-tuxcare.3","2.7.3-tuxcare.4","2.7.3-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-3+deb10u5"}]}],"versions":["2.9.8-3","2.9.8-3+deb10u1","2.9.8-3+deb10u2","2.9.8-3+deb10u3","2.9.8-3+deb10u4"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10.4"}]}],"versions":["2.0.0","2.0.0-RC1","2.0.0-RC2","2.0.0-RC3","2.0.1","2.0.2","2.0.4","2.0.5","2.0.6","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.2.0","2.2.0-rc1","2.2.1","2.2.2","2.2.3","2.2.4","2.3.0","2.3.0-rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.0-rc1","2.4.0-rc2","2.4.0-rc3","2.4.1","2.4.1.1","2.4.1.2","2.4.1.3","2.4.2","2.4.3","2.4.4","2.4.5","2.4.5.1","2.4.6","2.4.6.1","2.5.0","2.5.0-rc1","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.0","2.6.0-rc1","2.6.0-rc2","2.6.0-rc3","2.6.0-rc4","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.7.1","2.6.7.2","2.6.7.3","2.6.7.4","2.6.7.5","2.7.0","2.7.0-rc1","2.7.0-rc2","2.7.0-rc3","2.7.1","2.7.1-1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.7.9.1","2.7.9.2","2.7.9.3","2.7.9.4","2.7.9.5","2.7.9.6","2.7.9.7","2.8.0","2.8.0.rc1","2.8.0.rc2","2.8.1","2.8.10","2.8.11","2.8.11.1","2.8.11.2","2.8.11.3","2.8.11.4","2.8.11.5","2.8.11.6","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.8.1","2.8.9","2.9.0","2.9.0.pr1","2.9.0.pr2","2.9.0.pr3","2.9.0.pr4","2.9.1","2.9.10","2.9.10.1","2.9.10.2","2.9.10.3","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2.9.9.1","2.9.9.2","2.9.9.3"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-3.oe1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-aikido.5"},{"fixed":"2.3.1-aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-root.io.1"},{"fixed":"2.5.2-root.io.2"},{"fixed":"2.3.1-root.io.5"},{"fixed":"2.3.1-root.io.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-1","2.2.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-2","2.4.2-3","2.4.2-3ubuntu0.1~esm1","2.4.2-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.6-1","2.9.1-1","2.9.4-1","2.9.5-1","2.9.8-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.9.3-1","2.10.0-2","2.10.1-1","2.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-1","2.12.5-1","2.13.0-1","2.13.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1build1","2.14.0+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-1build1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fasterxml","product":"jackson-databind"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"oracle","product":"retail_merchandising_system"},{"vendor":"oracle","product":"retail_sales_audit"}],"references":[{"url":"https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/advisories/GHSA-rpr3-cw39-3pxh","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/2658","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/a424c038ba0c0d65e579e22001dec925902ac0ef","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00032.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230818-0007/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10650","tags":["advisory"]},{"url":"https://github.com/luisgarciacheckmarx/LGV_onefile/issues/19","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/2864","tags":["web"]},{"url":"https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20230818-0007","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-10650","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind","tags":["package"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1129","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-10650","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10650","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-10650","description":"A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.","status":"published","published":"2022-12-26T00:00:00Z","modified":"2025-04-14T16:22:00.404Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:47.877975Z"}],"euvd":[{"id":"EUVD-2022-6411","description":"A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.","status":"published","published":"2022-12-26T00:00:00Z","modified":"2025-04-14T16:22:00Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:33.465211Z"}],"ghsa":[{"id":"GHSA-rpr3-cw39-3pxh","title":"jackson-databind vulnerable to unsafe deserialization","description":"The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling interactions related to the class `ignite-jta`.","status":"published","published":"2022-07-15T19:41:47Z","modified":"2025-04-14T22:08:44Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:38:39.85223Z"}],"nvd":[{"id":"CVE-2020-10650","description":"A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.","status":"published","published":"2022-12-26T20:15:10.433Z","modified":"2026-06-17T02:48:10.007Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:06:47.286386Z"}],"osv":[{"id":"CVE-2020-10650","description":"A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.","status":"published","published":"2022-12-26T20:15:10.433Z","modified":"2026-10-20T13:49:06.157929371Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2020-10650","description":"A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.","status":"published","published":"2022-12-26T20:15:10.433Z","modified":"2026-10-26T12:00:16.170760003Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-rpr3-cw39-3pxh","title":"jackson-databind vulnerable to unsafe deserialization","description":"The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling interactions related to the class `ignite-jta`.","status":"published","published":"2022-07-15T19:41:47Z","modified":"2026-07-08T06:00:01.572650992Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"OESA-2021-1129","title":"subversion security update","description":"Subversion exists to be universally recognized and adopted as an open-source, centralized version control system characterized by its reliability as a safe haven for valuable data; the simplicity of its model and usage; and its ability to support the needs of a wide variety of users and projects, from individuals to large-scale enterprise operations.\r\n\r\nSecurity Fix(es):\r\n\r\nA null-pointer-dereference flaw was found in mod_authz_svn of subversion. This flaw allows a remote, unauthenticated attacker to cause a denial of service in some server configurations. The highest threat from this vulnerability is to system availability.(CVE-2020-10650)","status":"published","published":"2021-04-07T11:04:22Z","modified":"2026-08-18T01:15:26.214980841Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2020-10650","description":"A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.","status":"published","published":"2022-12-26T20:15:00Z","modified":"2026-10-17T12:56:10.873630485Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"CLSA-2026-1793208072","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (31 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 31 CVEs. Fixed in 2.5.4-tuxcare.2.","status":"published","published":"2026-10-28T17:21:12Z","modified":"2026-11-06T13:28:02.042118205Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793866911","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.10.2-tuxcare.4.","status":"published","published":"2026-11-05T09:21:52Z","modified":"2026-11-05T13:15:05.738682514Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793867014","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.9.1-tuxcare.3.","status":"published","published":"2026-11-05T09:23:34Z","modified":"2026-11-05T13:15:03.276940403Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793867520","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.9.2-tuxcare.4.","status":"published","published":"2026-11-05T09:32:00Z","modified":"2026-11-05T13:15:03.284820057Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793867639","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.9.3-tuxcare.6.","status":"published","published":"2026-11-05T09:34:00Z","modified":"2026-11-05T13:15:05.088116605Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793868698","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.9.10.3-tuxcare.6.","status":"published","published":"2026-11-05T09:51:38Z","modified":"2026-11-05T13:15:02.29473029Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793869897","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.9.10-tuxcare.5.","status":"published","published":"2026-11-05T10:11:37Z","modified":"2026-11-05T13:15:06.597966301Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793870384","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.9.9.1-tuxcare.5.","status":"published","published":"2026-11-05T10:19:45Z","modified":"2026-11-05T13:15:08.25412597Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793870822","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.9.9.3-tuxcare.5.","status":"published","published":"2026-11-05T10:27:03Z","modified":"2026-11-05T13:15:10.178688595Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793957557","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.7.5-tuxcare.6.","status":"published","published":"2026-11-06T10:32:37Z","modified":"2026-11-06T13:15:14.377544064Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793957775","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (11 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 11 CVEs. Fixed in 2.8.11-tuxcare.6.","status":"published","published":"2026-11-06T10:36:15Z","modified":"2026-11-06T13:15:14.77804091Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1794221834","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (22 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 22 CVEs. Fixed in 2.9.8-tuxcare.5.","status":"published","published":"2026-11-09T11:57:15Z","modified":"2026-11-09T19:15:05.428737975Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794222386","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (13 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 13 CVEs. Fixed in 2.8.11.4-tuxcare.5.","status":"published","published":"2026-11-09T12:06:27Z","modified":"2026-11-09T19:15:09.533317993Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794223928","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (15 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 15 CVEs. Fixed in 2.9.5-tuxcare.5.","status":"published","published":"2026-11-09T12:32:10Z","modified":"2026-11-09T19:15:03.930133437Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794223990","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (14 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 14 CVEs. Fixed in 2.8.11.3-tuxcare.5.","status":"published","published":"2026-11-09T12:33:10Z","modified":"2026-11-09T19:15:08.71813093Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794224575","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (15 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 15 CVEs. Fixed in 2.9.9-tuxcare.4.","status":"published","published":"2026-11-09T12:42:56Z","modified":"2026-11-09T19:15:03.892515361Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794224690","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (15 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 15 CVEs. Fixed in 2.8.4-tuxcare.7.","status":"published","published":"2026-11-09T12:44:51Z","modified":"2026-11-09T19:15:04.426533193Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794225369","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (18 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 18 CVEs. Fixed in 2.9.7-tuxcare.5.","status":"published","published":"2026-11-09T12:56:10Z","modified":"2026-11-09T19:15:08.722624956Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794225652","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (18 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 18 CVEs. Fixed in 2.9.4-tuxcare.6.","status":"published","published":"2026-11-09T13:00:53Z","modified":"2026-11-09T19:15:02.893434073Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794226057","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.7.9-tuxcare.6.","status":"published","published":"2026-11-09T13:07:38Z","modified":"2026-11-09T19:15:05.740816879Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794226417","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.6.7.2-tuxcare.4.","status":"published","published":"2026-11-09T13:13:37Z","modified":"2026-11-09T19:15:08.473507537Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794226556","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.6.5-tuxcare.4.","status":"published","published":"2026-11-09T13:15:57Z","modified":"2026-11-09T19:15:02.887983836Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794229690","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.7.0-tuxcare.5.","status":"published","published":"2026-11-09T14:08:11Z","modified":"2026-11-09T19:15:08.471565825Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794232556","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.7.9.7-tuxcare.6.","status":"published","published":"2026-11-09T14:55:57Z","modified":"2026-11-09T19:15:14.0866682Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794232852","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.6.7.1-tuxcare.4.","status":"published","published":"2026-11-09T15:00:53Z","modified":"2026-11-09T19:15:06.74753056Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794303155","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.7.9.3-tuxcare.6.","status":"published","published":"2026-11-10T10:32:36Z","modified":"2026-11-10T13:15:04.392956747Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"CLSA-2026-1794303249","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.7.8-tuxcare.6.","status":"published","published":"2026-11-10T10:34:10Z","modified":"2026-11-10T13:15:06.351041875Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"CLSA-2026-1794304579","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.8.10-tuxcare.8.","status":"published","published":"2026-11-10T10:56:19Z","modified":"2026-11-10T13:15:06.345649086Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"CLSA-2026-1794305366","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.10.3-tuxcare.6.","status":"published","published":"2026-11-10T11:09:27Z","modified":"2026-11-10T13:15:06.344258262Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"CLSA-2026-1794306626","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.8.11.1-tuxcare.6.","status":"published","published":"2026-11-10T11:30:27Z","modified":"2026-11-10T13:15:04.380368659Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"CLSA-2026-1794330953","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.7.1-tuxcare.7.","status":"published","published":"2026-11-10T18:15:54Z","modified":"2026-11-11T01:30:02.948997154Z","updated_at":"2026-11-11T01:47:54.277886Z"},{"id":"CLSA-2026-1794331020","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.7.3-tuxcare.6.","status":"published","published":"2026-11-10T18:17:00Z","modified":"2026-11-11T01:30:02.389717877Z","updated_at":"2026-11-11T01:47:54.277886Z"},{"id":"DLA-3407-1","title":"jackson-databind - security update","status":"published","published":"2023-04-30T00:00:00Z","modified":"2026-03-09T01:22:57.932275Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"ROOT-APP-MAVEN-CVE-2020-10650","title":"CVE-2020-10650 in com.fasterxml.jackson.core:jackson-databind - Patched by Root","description":"Root has patched CVE-2020-10650 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-08-24T12:30:14Z","modified":"2026-08-24T14:30:19.573617575Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}