{"id":"CVE-2026-83557","aliases":["CLSA-2026-1789307500","CLSA-2026-1789494210","CLSA-2026-1791545828","CLSA-2026-1791781917","CLSA-2026-1792441007","CLSA-2026-1792441009","CLSA-2026-1792441229","CLSA-2026-1792441426","CLSA-2026-1792441448","CLSA-2026-1792441664","CLSA-2026-1792475167","CLSA-2026-1792478714","CLSA-2026-1792479357","CLSA-2026-1792516705","CLSA-2026-1792517919","CLSA-2026-1792517950","CLSA-2026-1792517982","CLSA-2026-1793200760","CLSA-2026-1793208270","CLSA-2026-1793208938","CLSA-2026-1793209495","CLSA-2026-1793273384","CLSA-2026-1793274468","CLSA-2026-1793274960","CLSA-2026-1793295575","CLSA-2026-1793348493","CLSA-2026-1793348823","CLSA-2026-1793348906","CLSA-2026-1793349274","CLSA-2026-1793349383","CLSA-2026-1793362223","CLSA-2026-1793363147","CLSA-2026-1793522726","CLSA-2026-1793531937","CLSA-2026-1793532239","CLSA-2026-1793532432","CLSA-2026-1793532868","CLSA-2026-1793533147","CLSA-2026-1793544702","CLSA-2026-1793544811","CLSA-2026-1793544907","CLSA-2026-1793866208","CLSA-2026-1793866335","CLSA-2026-1793866444","CLSA-2026-1793866586","CLSA-2026-1793866695","CLSA-2026-1793866799","CLSA-2026-1793866911","CLSA-2026-1793867014","CLSA-2026-1793867120","CLSA-2026-1793867313","CLSA-2026-1793867418","CLSA-2026-1793867520","CLSA-2026-1793867639","CLSA-2026-1793867735","CLSA-2026-1793867936","CLSA-2026-1793868222","CLSA-2026-1793868351","CLSA-2026-1793868587","CLSA-2026-1793868698","CLSA-2026-1793868792","CLSA-2026-1793868907","CLSA-2026-1793869012","CLSA-2026-1793869349","CLSA-2026-1793869497","CLSA-2026-1793869592","CLSA-2026-1793869797","CLSA-2026-1793869996","CLSA-2026-1793870384","CLSA-2026-1793870822","CLSA-2026-1793870954","CLSA-2026-1793871212","CLSA-2026-1793872651","CLSA-2026-1793872873","CLSA-2026-1793957665","CLSA-2026-1793957884","CLSA-2026-1793957997","CLSA-2026-1793958100","CLSA-2026-1793958230","CLSA-2026-1793958328","CLSA-2026-1794221834","CLSA-2026-1794221927","CLSA-2026-1794222244","CLSA-2026-1794225369","CLSA-2026-1794226255","CLSA-2026-1794226417","CLSA-2026-1794231332","CLSA-2026-1794232852","DEBIAN-CVE-2026-83557","EUVD-2026-69250","GHSA-gx83-3vf8-gh7j","RHLW-2026-09128b29f89dc8ed","RHLW-2026-804d65df1a73952a","ROOT-APP-MAVEN-CVE-2026-83557","SUSE-SU-2026:24149-1","SUSE-SU-2026:4394-1","UBUNTU-CVE-2026-83557","openSUSE-SU-2026:11877-1","openSUSE-SU-2026:22034-1"],"status":"published","title":"jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00717,"percentile":0.54299,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502","CWE-915"],"published":"2026-09-01T14:57:01Z","modified":"2026-11-09T19:15:08Z","fixes":[{"ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","fixed_in":["3.1.6","3.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.18.10","2.21.6","2.22.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.6.3-tuxcare.4","2.5.4-tuxcare.4","2.9.10.4-tuxcare.5","2.18.3-tuxcare.6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jackson-databind","fixed_in":["2.18.11-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-databind","fixed_in":["3.1.6-aikido.1","3.2.2-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.18.10-aikido.1","2.21.6-aikido.1","2.22.2-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-databind","fixed_in":["3.1.6-root.io.1","3.2.2-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.18.10-root.io.1","2.21.6-root.io.1","2.22.2-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.18.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.21.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"fixed":"2.22.2"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.3"},{"fixed":"2.17.3-tuxcare.2"}]}],"versions":["2.17.3","2.17.3-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.2"},{"fixed":"2.17.2-tuxcare.1"}]}],"versions":["2.17.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.1"},{"fixed":"2.17.1-tuxcare.1"}]}],"versions":["2.17.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.4.2"},{"fixed":"2.13.4.2-tuxcare.1"}]}],"versions":["2.13.4.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.0"},{"fixed":"2.15.0-tuxcare.1"}]}],"versions":["2.15.0"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.4"},{"fixed":"2.13.4-tuxcare.1"}]}],"versions":["2.13.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.3"},{"fixed":"2.14.3-tuxcare.1"}]}],"versions":["2.14.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.4"},{"fixed":"2.15.4-tuxcare.1"}]}],"versions":["2.15.4"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.3"},{"fixed":"2.15.3-tuxcare.1"}]}],"versions":["2.15.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.2"},{"fixed":"2.15.2-tuxcare.1"}]}],"versions":["2.15.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.1"},{"fixed":"2.16.1-tuxcare.1"}]}],"versions":["2.16.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.5"},{"fixed":"2.13.5-tuxcare.1"}]}],"versions":["2.13.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.2"},{"fixed":"2.14.2-tuxcare.3"}]}],"versions":["2.14.2","2.14.2-tuxcare.1","2.14.2-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.0"},{"fixed":"2.16.0-tuxcare.1"}]}],"versions":["2.16.0"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0"},{"fixed":"2.17.0-tuxcare.1"}]}],"versions":["2.17.0"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.2"},{"fixed":"2.16.2-tuxcare.1"}]}],"versions":["2.16.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.1"},{"fixed":"2.15.1-tuxcare.1"}]}],"versions":["2.15.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.1"},{"fixed":"2.14.1-tuxcare.2"}]}],"versions":["2.14.1","2.14.1-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.1"},{"fixed":"2.11.1-tuxcare.3"}]}],"versions":["2.11.1","2.11.1-tuxcare.1","2.11.1-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.3"}]}],"versions":["2.12.1","2.12.1-tuxcare.1","2.12.1-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.0-tuxcare.2"}]}],"versions":["2.11.0","2.11.0-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.6.1"},{"fixed":"2.12.6.1-tuxcare.3"}]}],"versions":["2.12.6.1","2.12.6.1-tuxcare.1","2.12.6.1-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.6"},{"fixed":"2.12.6-tuxcare.2"}]}],"versions":["2.12.6","2.12.6-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.7"},{"fixed":"2.12.7-tuxcare.3"}]}],"versions":["2.12.7","2.12.7-tuxcare.1","2.12.7-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.13.0-tuxcare.3"}]}],"versions":["2.13.0","2.13.0-tuxcare.1","2.13.0-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.19.0-tuxcare.2"}]}],"versions":["2.19.0","2.19.0-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.4"},{"fixed":"2.11.4-tuxcare.3"}]}],"versions":["2.11.4","2.11.4-tuxcare.1","2.11.4-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.3"},{"fixed":"2.11.3-tuxcare.4"}]}],"versions":["2.11.3","2.11.3-tuxcare.1","2.11.3-tuxcare.2","2.11.3-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.1"},{"fixed":"2.20.1-tuxcare.3"}]}],"versions":["2.20.1","2.20.1-tuxcare.1","2.20.1-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.4"},{"fixed":"2.12.4-tuxcare.3"}]}],"versions":["2.12.4","2.12.4-tuxcare.1","2.12.4-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.4"},{"fixed":"2.18.4-tuxcare.3"}]}],"versions":["2.18.4","2.18.4-tuxcare.1","2.18.4-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.1"},{"fixed":"2.13.1-tuxcare.3"}]}],"versions":["2.13.1","2.13.1-tuxcare.1","2.13.1-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.2"},{"fixed":"2.12.2-tuxcare.3"}]}],"versions":["2.12.2","2.12.2-tuxcare.1","2.12.2-tuxcare.2"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.4"},{"fixed":"2.21.4-tuxcare.2"}]}],"versions":["2.21.4","2.21.4-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.4"},{"fixed":"2.19.4-tuxcare.2"}]}],"versions":["2.19.4","2.19.4-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.5"},{"fixed":"2.12.5-tuxcare.3"}]}],"versions":["2.12.5","2.12.5-tuxcare.1","2.12.5-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.2"},{"fixed":"2.19.2-tuxcare.2"}]}],"versions":["2.19.2","2.19.2-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.2.2"},{"fixed":"2.13.2.2-tuxcare.3"}]}],"versions":["2.13.2.2","2.13.2.2-tuxcare.1","2.13.2.2-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.7.1"},{"fixed":"2.12.7.1-tuxcare.4"}]}],"versions":["2.12.7.1","2.12.7.1-tuxcare.1","2.12.7.1-tuxcare.2","2.12.7.1-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.3"},{"fixed":"2.13.3-tuxcare.2"}]}],"versions":["2.13.3","2.13.3-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.2"},{"fixed":"2.11.2-tuxcare.2"}]}],"versions":["2.11.2","2.11.2-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.7"},{"fixed":"2.8.7-tuxcare.6"}]}],"versions":["2.8.7","2.8.7-tuxcare.1","2.8.7-tuxcare.2","2.8.7-tuxcare.3","2.8.7-tuxcare.4","2.8.7-tuxcare.5"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.8"},{"fixed":"2.7.8-tuxcare.5"}]}],"versions":["2.7.8","2.7.8-tuxcare.1","2.7.8-tuxcare.2","2.7.8-tuxcare.3","2.7.8-tuxcare.4"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.0-tuxcare.4"}]}],"versions":["2.7.0","2.7.0-tuxcare.1","2.7.0-tuxcare.2","2.7.0-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9.3"},{"fixed":"2.7.9.3-tuxcare.4"}]}],"versions":["2.7.9.3","2.7.9.3-tuxcare.1","2.7.9.3-tuxcare.2","2.7.9.3-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.3"},{"fixed":"2.4.3-tuxcare.4"}]}],"versions":["2.4.3","2.4.3-tuxcare.1","2.4.3-tuxcare.2","2.4.3-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9"},{"fixed":"2.9.9-tuxcare.3"}]}],"versions":["2.9.9","2.9.9-tuxcare.1","2.9.9-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.2"},{"fixed":"2.10.2-tuxcare.4"}]}],"versions":["2.10.2","2.10.2-tuxcare.1","2.10.2-tuxcare.2","2.10.2-tuxcare.3"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1-tuxcare.3"}]}],"versions":["2.9.1","2.9.1-tuxcare.1","2.9.1-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3"},{"fixed":"2.10.3-tuxcare.4"}]}],"versions":["2.10.3","2.10.3-tuxcare.1","2.10.3-tuxcare.2","2.10.3-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.4"},{"fixed":"2.9.4-tuxcare.5"}]}],"versions":["2.9.4","2.9.4-tuxcare.1","2.9.4-tuxcare.2","2.9.4-tuxcare.3","2.9.4-tuxcare.4"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.5"},{"fixed":"2.8.5-tuxcare.5"}]}],"versions":["2.8.5","2.8.5-tuxcare.1","2.8.5-tuxcare.2","2.8.5-tuxcare.3","2.8.5-tuxcare.4"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.2"},{"fixed":"2.9.2-tuxcare.4"}]}],"versions":["2.9.2","2.9.2-tuxcare.1","2.9.2-tuxcare.2","2.9.2-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.3"},{"fixed":"2.9.3-tuxcare.6"}]}],"versions":["2.9.3","2.9.3-tuxcare.1","2.9.3-tuxcare.2","2.9.3-tuxcare.3","2.9.3-tuxcare.4","2.9.3-tuxcare.5"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.3"},{"fixed":"2.8.11.3-tuxcare.4"}]}],"versions":["2.8.11.3","2.8.11.3-tuxcare.1","2.8.11.3-tuxcare.2","2.8.11.3-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11"},{"fixed":"2.8.11-tuxcare.5"}]}],"versions":["2.8.11","2.8.11-tuxcare.1","2.8.11-tuxcare.2","2.8.11-tuxcare.3","2.8.11-tuxcare.4"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.4"},{"fixed":"2.8.11.4-tuxcare.4"}]}],"versions":["2.8.11.4","2.8.11.4-tuxcare.1","2.8.11.4-tuxcare.2","2.8.11.4-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.3"},{"fixed":"2.7.3-tuxcare.4"}]}],"versions":["2.7.3","2.7.3-tuxcare.1","2.7.3-tuxcare.2","2.7.3-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.5"},{"fixed":"2.7.5-tuxcare.5"}]}],"versions":["2.7.5","2.7.5-tuxcare.1","2.7.5-tuxcare.2","2.7.5-tuxcare.3","2.7.5-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.3"},{"fixed":"2.9.10.3-tuxcare.6"}]}],"versions":["2.9.10.3","2.9.10.3-tuxcare.1","2.9.10.3-tuxcare.2","2.9.10.3-tuxcare.3","2.9.10.3-tuxcare.4","2.9.10.3-tuxcare.5"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5"},{"fixed":"2.4.5-tuxcare.4"}]}],"versions":["2.4.5","2.4.5-tuxcare.1","2.4.5-tuxcare.2","2.4.5-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.7"},{"fixed":"2.9.10.7-tuxcare.4"}]}],"versions":["2.9.10.7","2.9.10.7-tuxcare.1","2.9.10.7-tuxcare.2","2.9.10.7-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.5"},{"fixed":"2.9.10.5-tuxcare.2"}]}],"versions":["2.9.10.5","2.9.10.5-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9.7"},{"fixed":"2.7.9.7-tuxcare.5"}]}],"versions":["2.7.9.7","2.7.9.7-tuxcare.1","2.7.9.7-tuxcare.2","2.7.9.7-tuxcare.3","2.7.9.7-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.5.1"},{"fixed":"2.10.5.1-tuxcare.4"}]}],"versions":["2.10.5.1","2.10.5.1-tuxcare.1","2.10.5.1-tuxcare.2","2.10.5.1-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1"},{"fixed":"2.7.1-tuxcare.6"}]}],"versions":["2.7.1","2.7.1-tuxcare.1","2.7.1-tuxcare.2","2.7.1-tuxcare.3","2.7.1-tuxcare.4","2.7.1-tuxcare.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.8"},{"fixed":"2.9.10.8-tuxcare.4"}]}],"versions":["2.9.10.8","2.9.10.8-tuxcare.1","2.9.10.8-tuxcare.2","2.9.10.8-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.10"},{"fixed":"2.8.10-tuxcare.6"}]}],"versions":["2.8.10","2.8.10-tuxcare.1","2.8.10-tuxcare.2","2.8.10-tuxcare.3","2.8.10-tuxcare.4","2.8.10-tuxcare.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9.1"},{"fixed":"2.9.9.1-tuxcare.5"}]}],"versions":["2.9.9.1","2.9.9.1-tuxcare.1","2.9.9.1-tuxcare.2","2.9.9.1-tuxcare.3","2.9.9.1-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9.3"},{"fixed":"2.9.9.3-tuxcare.5"}]}],"versions":["2.9.9.3","2.9.9.3-tuxcare.1","2.9.9.3-tuxcare.2","2.9.9.3-tuxcare.3","2.9.9.3-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.3"},{"fixed":"2.6.3-tuxcare.4"}]}],"versions":["2.6.3","2.6.3-tuxcare.1","2.6.3-tuxcare.2","2.6.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.5"}]}],"versions":["2.7.9","2.7.9-tuxcare.1","2.7.9-tuxcare.2","2.7.9-tuxcare.3","2.7.9-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.4"},{"fixed":"2.5.4-tuxcare.4"}]}],"versions":["2.5.4","2.5.4-tuxcare.1","2.5.4-tuxcare.2","2.5.4-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.4"},{"fixed":"2.9.10.4-tuxcare.5"}]}],"versions":["2.9.10.4","2.9.10.4-tuxcare.1","2.9.10.4-tuxcare.2","2.9.10.4-tuxcare.3","2.9.10.4-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.6"},{"fixed":"2.6.6-tuxcare.4"}]}],"versions":["2.6.6","2.6.6-tuxcare.1","2.6.6-tuxcare.2","2.6.6-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.4"},{"fixed":"2.1.4-tuxcare.2"}]}],"versions":["2.1.4","2.1.4-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.3"},{"fixed":"2.2.3-tuxcare.3"}]}],"versions":["2.2.3","2.2.3-tuxcare.1","2.2.3-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.1"},{"fixed":"2.8.11.1-tuxcare.4"}]}],"versions":["2.8.11.1","2.8.11.1-tuxcare.1","2.8.11.1-tuxcare.2","2.8.11.1-tuxcare.3"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.2"},{"fixed":"2.18.2-tuxcare.4"}]}],"versions":["2.18.2","2.18.2-tuxcare.1","2.18.2-tuxcare.2","2.18.2-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.4"},{"fixed":"2.10.4-tuxcare.4"}]}],"versions":["2.10.4","2.10.4-tuxcare.1","2.10.4-tuxcare.2","2.10.4-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.8"},{"fixed":"2.9.8-tuxcare.5"}]}],"versions":["2.9.8","2.9.8-tuxcare.1","2.9.8-tuxcare.2","2.9.8-tuxcare.3","2.9.8-tuxcare.4"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.0-tuxcare.4"}]}],"versions":["2.4.0","2.4.0-tuxcare.1","2.4.0-tuxcare.2","2.4.0-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.1"},{"fixed":"2.4.1-tuxcare.4"}]}],"versions":["2.4.1","2.4.1-tuxcare.1","2.4.1-tuxcare.2","2.4.1-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.7"},{"fixed":"2.9.7-tuxcare.5"}]}],"versions":["2.9.7","2.9.7-tuxcare.1","2.9.7-tuxcare.2","2.9.7-tuxcare.3","2.9.7-tuxcare.4"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.1.1"},{"fixed":"2.4.1.1-tuxcare.4"}]}],"versions":["2.4.1.1","2.4.1.1-tuxcare.1","2.4.1.1-tuxcare.2","2.4.1.1-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7.2"},{"fixed":"2.6.7.2-tuxcare.4"}]}],"versions":["2.6.7.2","2.6.7.2-tuxcare.1","2.6.7.2-tuxcare.2","2.6.7.2-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.3"},{"fixed":"2.18.3-tuxcare.6"}]}],"versions":["2.18.3","2.18.3-tuxcare.1","2.18.3-tuxcare.2","2.18.3-tuxcare.3","2.18.3-tuxcare.4","2.18.3-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7.1"},{"fixed":"2.6.7.1-tuxcare.4"}]}],"versions":["2.6.7.1","2.6.7.1-tuxcare.1","2.6.7.1-tuxcare.2","2.6.7.1-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-2","2.14.0+ds-3","2.14.0-1","2.14.0-1+deb12u1","2.18.11-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-1+deb13u1","2.14.0+ds-2","2.14.0+ds-3","2.18.11-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-1"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-2","2.14.0+ds-3"]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.6"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5"]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.2"}]}],"versions":["3.2.0","3.2.1"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.18.10"}]}],"versions":["2.11.0","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1","2.13.2.2","2.13.3","2.13.4","2.13.4.1","2.13.4.2","2.13.5","2.14.0","2.14.0-rc1","2.14.0-rc2","2.14.0-rc3","2.14.1","2.14.2","2.14.3","2.15.0","2.15.0-rc1","2.15.0-rc2","2.15.0-rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0-rc1","2.16.1","2.16.2","2.17.0","2.17.0-rc1","2.17.1","2.17.2","2.17.3","2.18.0","2.18.0-rc1","2.18.1","2.18.2","2.18.3","2.18.4","2.18.5","2.18.6","2.18.7","2.18.8","2.18.9"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.21.6"}]}],"versions":["2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.0-rc1","2.20.1","2.20.2","2.21.0","2.21.1","2.21.2","2.21.3","2.21.4","2.21.5"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"fixed":"2.22.2"}]}],"versions":["2.22.0","2.22.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.3.rhlw-00013"}]}],"versions":["2.0.0","2.0.0-RC1","2.0.0-RC2","2.0.0-RC3","2.0.1","2.0.2","2.0.4","2.0.5","2.0.6","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.5.1","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1","2.13.2.2","2.13.3","2.13.4","2.13.4.1","2.13.4.2","2.13.5","2.14.0","2.14.0-rc1","2.14.0-rc2","2.14.0-rc3","2.14.1","2.14.2","2.14.3","2.15.0","2.15.0-rc1","2.15.0-rc2","2.15.0-rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0-rc1","2.16.1","2.16.2","2.17.0","2.17.0-rc1","2.17.1","2.17.2","2.17.3","2.2.0","2.2.0-rc1","2.2.1","2.2.2","2.2.3","2.2.4","2.3.0","2.3.0-rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.0-rc1","2.4.0-rc2","2.4.0-rc3","2.4.1","2.4.1.1","2.4.1.2","2.4.1.3","2.4.2","2.4.3","2.4.4","2.4.5","2.4.5.1","2.4.6","2.4.6.1","2.5.0","2.5.0-rc1","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.0","2.6.0-rc1","2.6.0-rc2","2.6.0-rc3","2.6.0-rc4","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.7.1","2.6.7.2","2.6.7.3","2.6.7.4","2.6.7.5","2.7.0","2.7.0-rc1","2.7.0-rc2","2.7.0-rc3","2.7.1","2.7.1-1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.7.9.1","2.7.9.2","2.7.9.3","2.7.9.4","2.7.9.5","2.7.9.6","2.7.9.7","2.8.0","2.8.0.rc1","2.8.0.rc2","2.8.1","2.8.10","2.8.11","2.8.11.1","2.8.11.2","2.8.11.3","2.8.11.4","2.8.11.5","2.8.11.6","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.8.1","2.8.9","2.9.0","2.9.0.pr1","2.9.0.pr2","2.9.0.pr3","2.9.0.pr4","2.9.1","2.9.10","2.9.10.1","2.9.10.2","2.9.10.3","2.9.10.4","2.9.10.5","2.9.10.6","2.9.10.7","2.9.10.8","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2.9.9.1","2.9.9.2","2.9.9.3"],"bundled":8},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0.rhlw-00010"}]}],"versions":["2.0.0","2.0.0-RC1","2.0.0-RC2","2.0.0-RC3","2.0.1","2.0.2","2.0.4","2.0.5","2.0.6","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.5.1","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1","2.13.2.2","2.13.3","2.13.4","2.13.4.1","2.13.4.2","2.13.5","2.14.0","2.14.0-rc1","2.14.0-rc2","2.14.0-rc3","2.14.1","2.14.2","2.14.3","2.15.0","2.15.0-rc1","2.15.0-rc2","2.15.0-rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0-rc1","2.16.1","2.16.2","2.17.0","2.17.0-rc1","2.17.1","2.17.2","2.17.3","2.18.0","2.18.0-rc1","2.2.0","2.2.0-rc1","2.2.1","2.2.2","2.2.3","2.2.4","2.3.0","2.3.0-rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.0-rc1","2.4.0-rc2","2.4.0-rc3","2.4.1","2.4.1.1","2.4.1.2","2.4.1.3","2.4.2","2.4.3","2.4.4","2.4.5","2.4.5.1","2.4.6","2.4.6.1","2.5.0","2.5.0-rc1","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.0","2.6.0-rc1","2.6.0-rc2","2.6.0-rc3","2.6.0-rc4","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.7.1","2.6.7.2","2.6.7.3","2.6.7.4","2.6.7.5","2.7.0","2.7.0-rc1","2.7.0-rc2","2.7.0-rc3","2.7.1","2.7.1-1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.7.9.1","2.7.9.2","2.7.9.3","2.7.9.4","2.7.9.5","2.7.9.6","2.7.9.7","2.8.0","2.8.0.rc1","2.8.0.rc2","2.8.1","2.8.10","2.8.11","2.8.11.1","2.8.11.2","2.8.11.3","2.8.11.4","2.8.11.5","2.8.11.6","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.8.1","2.8.9","2.9.0","2.9.0.pr1","2.9.0.pr2","2.9.0.pr3","2.9.0.pr4","2.9.1","2.9.10","2.9.10.1","2.9.10.2","2.9.10.3","2.9.10.4","2.9.10.5","2.9.10.6","2.9.10.7","2.9.10.8","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2.9.9.1","2.9.9.2","2.9.9.3"],"bundled":7},{"source":"osv","ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-aikido.1"},{"fixed":"3.2.2-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.10-aikido.1"},{"fixed":"2.21.6-aikido.1"},{"fixed":"2.22.2-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-root.io.1"},{"fixed":"3.2.2-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.10-root.io.1"},{"fixed":"2.21.6-root.io.1"},{"fixed":"2.22.2-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-1","2.2.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-2","2.4.2-3","2.4.2-3ubuntu0.1~esm1","2.4.2-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.6-1","2.9.1-1","2.9.4-1","2.9.5-1","2.9.8-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.9.3-1","2.10.0-2","2.10.1-1","2.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-1","2.12.5-1","2.13.0-1","2.13.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1build1","2.14.0+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10}],"products":[{"vendor":"fasterxml","product":"jackson-databind"}],"references":[{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","tags":["third-party-advisory","exploit","advisory","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/6155","tags":["patch","issue-tracking","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/6156","tags":["issue-tracking","report","web"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","tags":["patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-83557","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54512.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5988","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54515.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5962","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5964","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/6129","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77310.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54514.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54514","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/5951","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-hgj6-7826-r7m5","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59888.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59888","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/5974","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-3pjw-73gf-8qr5","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36839","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40895","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43218","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43400","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44061","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44062","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44063","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44064","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44065","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44066","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44271","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48095","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50846","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50847","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50848","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50849","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54622","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62260","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54513","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54513.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5981","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5983","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/5984","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59889.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/6060","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/6056","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624149-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273856","tags":["report"]},{"url":"https://bugzilla.suse.com/1273857","tags":["report"]},{"url":"https://bugzilla.suse.com/1277883","tags":["report"]},{"url":"https://bugzilla.suse.com/1278008","tags":["report"]},{"url":"https://bugzilla.suse.com/1280125","tags":["report"]},{"url":"https://bugzilla.suse.com/1282491","tags":["report"]},{"url":"https://bugzilla.suse.com/1282492","tags":["report"]},{"url":"https://bugzilla.suse.com/1282505","tags":["report"]},{"url":"https://bugzilla.suse.com/1282641","tags":["report"]},{"url":"https://bugzilla.suse.com/1282645","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-83557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91777","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264394-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282639","tags":["report"]},{"url":"https://bugzilla.suse.com/1282640","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68496","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-83557","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-83557","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-83557","title":"jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.","status":"published","published":"2026-09-01T14:57:01.34Z","modified":"2026-09-01T17:46:40.145Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-502","CWE-915"],"updated_at":"2026-11-02T13:44:51.734189Z"}],"euvd":[{"id":"EUVD-2026-69250","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.","status":"published","published":"2026-09-01T14:57:01Z","modified":"2026-09-01T17:46:40Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:17.32054Z"}],"ghsa":[{"id":"GHSA-gx83-3vf8-gh7j","title":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)","description":"### Summary\n`DefaultBaseTypeLimitingValidator` — the `PolymorphicTypeValidator` used automatically whenever `@JsonTypeInfo` is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific \"unsafe base types\" (`Object`, `Serializable`, `Closeable`, `AutoCloseable`, `Cloneable`, `Runnable`, `java.util.logging.Handler`, `javax.naming.Referenceable`, `javax.sql.DataSource`). Its `isSafeSubType()` returns `true` unconditionally for every other base type. `java.lang.Comparable` is not in that list, despite being implemented by a very large fraction of JDK and application classes — comparable in breadth to `Serializable`, which is denylisted for exactly that reason. An application with an `@JsonTypeInfo`-annotated `Comparable`-typed property, and no custom validator configured, will accept a type identifier for essentially any class implementing `Comparable`.\n\n### Details\n**Affected file:** `src/main/java/tools/jackson/databind/jsontype/DefaultBaseTypeLimitingValidator.java`\n\n```java\nprivate final static class UnsafeBaseTypes {\n    private final Set\u003cString\u003e UNSAFE = new HashSet\u003c\u003e();\n    {\n        UNSAFE.add(Object.class.getName());\n        UNSAFE.add(java.io.Closeable.class.getName());\n        UNSAFE.add(java.io.Serializable.class.getName());\n        UNSAFE.add(AutoCloseable.class.getName());\n        UNSAFE.add(Cloneable.class.getName());\n        UNSAFE.add(Runnable.class.getName());          // [databind#5014]\n        UNSAFE.add(\"java.util.logging.Handler\");\n        UNSAFE.add(\"javax.naming.Referenceable\");\n        UNSAFE.add(\"javax.sql.DataSource\");\n        // java.lang.Comparable is NOT present here\n    }\n}\n\nprotected boolean isSafeSubType(DatabindContext ctxt,\n        JavaType baseType, JavaType subType) {\n    return true;   // unconditional for every base type not in UNSAFE\n}\n```\n\nThe class's own JavaDoc acknowledges the design (*\"Note that when using potentially unsafe base type like `java.lang.Object` a custom implementation... is needed\"*), so the trade-off of leaving broad base types unrestricted is intentional. The gap is that `Comparable` has the same breadth of implementers as the types this class *does* restrict, and its absence looks like an oversight rather than a deliberate choice — consistent with the ongoing, incremental nature of this list (`Runnable` was added recently for issue #5014).\n\nThis is specific to the **default, unconfigured validator** reached via bare `@JsonTypeInfo` usage. Global \"Default Typing\" via `activateDefaultTyping()` is **not** affected, because that method structurally requires an explicit `PolymorphicTypeValidator` argument — a correctly-configured `BasicPolymorphicTypeValidator` rejects the same payload under `activateDefaultTyping()`.\n\n### PoC\nBuilt entirely from source (jackson-databind + jackson-core + jackson-annotations, `javac`, OpenJDK 21, no third-party gadget libraries, no network access):\n\n**1. Sanity check (benign class, confirms the mechanism fires):**\n```java\nstatic class SafeThing implements Comparable\u003cSafeThing\u003e {\n    public String name;\n    public SafeThing() {}\n    public int compareTo(SafeThing o) { return 0; }\n}\nstatic class Holder {\n    @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)\n    public Comparable\u003c?\u003e value;\n}\n\nObjectMapper mapper = JsonMapper.builder().build();   // no custom PTV\nString json = \"{\\\"value\\\":{\\\"@class\\\":\\\"...SafeThing\\\",\\\"name\\\":\\\"hello\\\"}}\";\nHolder h = mapper.readValue(json, Holder.class);\n// RESULT: ACCEPTED, class=...SafeThing\n```\n\n**2. Real JDK class substitution:**\n```java\nString json = \"{\\\"value\\\":[\\\"java.io.File\\\",\\\"/etc/passwd\\\"]}\";\nHolder h = mapper.readValue(json, Holder.class);\n// RESULT: ACCEPTED, class=java.io.File value=/etc/passwd\n```\n\n**3. Negative control — Default Typing with an explicit custom PTV:**\n```java\nPolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()\n    .allowIfSubType(\"PtvGapTest4\").build();\nObjectMapper mapper = JsonMapper.builder()\n    .activateDefaultTyping(ptv, DefaultTyping.NON_FINAL).build();\n// same java.io.File payload\n// RESULT: REJECTED - InvalidTypeIdException: \"...denied resolution\"\n```\n\n**Observed output:**\n\n\n\n\n$ java -cp .:build/classes PtvGapTest3\nTrying: {\"value\":[\"java.io.File\",\"/etc/passwd\"]}\nACCEPTED, class=java.io.File value=/etc/passwd\n\n$ java -cp .:build/classes PtvGapTest4\nTrying malicious substitution: [\"PtvGapTest4$Holder\",{\"value\":[\"java.io.File\",\"/etc/passwd\"]}]\nREJECTED - InvalidTypeIdException: Could not resolve type id 'java.io.File' as a\nsubtype of java.lang.Comparable: Configured PolymorphicTypeValidator denied resolution\n\n\n\n\n### Impact\nAny application declaring an `@JsonTypeInfo`-annotated property or class with `Comparable` as its base type, without a separately configured restrictive `PolymorphicTypeValidator`, will accept a type identifier for essentially any class implementing `Comparable`. Concrete impact is demonstrated via `java.io.File`: an attacker can cause construction of a `File` object for an arbitrary, attacker-chosen path. On its own this is a controlled-object-instantiation primitive; if the application later calls path-sensitive or mutating methods on the received value, this becomes a path-traversal-adjacent primitive. \n\n**Suggested remediation:**\n1. Add `java.lang.Comparable` to `UnsafeBaseTypes.UNSAFE`.\n2. Audit other broad JDK interfaces (`java.lang.Iterable`, `java.util.EventListener`) for the same gap.\n3. Consider a narrower default for `isSafeSubType()` for base types outside the fixed denylist, rather than unconditional `true`.","status":"published","published":"2026-09-28T20:44:25Z","modified":"2026-09-28T20:44:27Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-502","CWE-915"],"updated_at":"2026-11-02T14:41:22.654187Z"}],"nvd":[{"id":"CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.","status":"published","published":"2026-09-01T15:17:37.987Z","modified":"2026-09-08T19:29:32.2Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-502","CWE-915"],"updated_at":"2026-11-02T14:12:43.04945Z"}],"osv":[{"id":"CVE-2026-83557","title":"jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.","status":"published","published":"2026-09-01T14:57:01.34Z","modified":"2026-10-28T11:01:36.155983572Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-502","CWE-915"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.","status":"published","published":"2026-09-01T15:17:37.987Z","modified":"2026-10-20T04:00:07.342422376Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"GHSA-gx83-3vf8-gh7j","title":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)","description":"### Summary\n`DefaultBaseTypeLimitingValidator` — the `PolymorphicTypeValidator` used automatically whenever `@JsonTypeInfo` is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific \"unsafe base types\" (`Object`, `Serializable`, `Closeable`, `AutoCloseable`, `Cloneable`, `Runnable`, `java.util.logging.Handler`, `javax.naming.Referenceable`, `javax.sql.DataSource`). Its `isSafeSubType()` returns `true` unconditionally for every other base type. `java.lang.Comparable` is not in that list, despite being implemented by a very large fraction of JDK and application classes — comparable in breadth to `Serializable`, which is denylisted for exactly that reason. An application with an `@JsonTypeInfo`-annotated `Comparable`-typed property, and no custom validator configured, will accept a type identifier for essentially any class implementing `Comparable`.\n\n### Details\n**Affected file:** `src/main/java/tools/jackson/databind/jsontype/DefaultBaseTypeLimitingValidator.java`\n\n```java\nprivate final static class UnsafeBaseTypes {\n    private final Set\u003cString\u003e UNSAFE = new HashSet\u003c\u003e();\n    {\n        UNSAFE.add(Object.class.getName());\n        UNSAFE.add(java.io.Closeable.class.getName());\n        UNSAFE.add(java.io.Serializable.class.getName());\n        UNSAFE.add(AutoCloseable.class.getName());\n        UNSAFE.add(Cloneable.class.getName());\n        UNSAFE.add(Runnable.class.getName());          // [databind#5014]\n        UNSAFE.add(\"java.util.logging.Handler\");\n        UNSAFE.add(\"javax.naming.Referenceable\");\n        UNSAFE.add(\"javax.sql.DataSource\");\n        // java.lang.Comparable is NOT present here\n    }\n}\n\nprotected boolean isSafeSubType(DatabindContext ctxt,\n        JavaType baseType, JavaType subType) {\n    return true;   // unconditional for every base type not in UNSAFE\n}\n```\n\nThe class's own JavaDoc acknowledges the design (*\"Note that when using potentially unsafe base type like `java.lang.Object` a custom implementation... is needed\"*), so the trade-off of leaving broad base types unrestricted is intentional. The gap is that `Comparable` has the same breadth of implementers as the types this class *does* restrict, and its absence looks like an oversight rather than a deliberate choice — consistent with the ongoing, incremental nature of this list (`Runnable` was added recently for issue #5014).\n\nThis is specific to the **default, unconfigured validator** reached via bare `@JsonTypeInfo` usage. Global \"Default Typing\" via `activateDefaultTyping()` is **not** affected, because that method structurally requires an explicit `PolymorphicTypeValidator` argument — a correctly-configured `BasicPolymorphicTypeValidator` rejects the same payload under `activateDefaultTyping()`.\n\n### PoC\nBuilt entirely from source (jackson-databind + jackson-core + jackson-annotations, `javac`, OpenJDK 21, no third-party gadget libraries, no network access):\n\n**1. Sanity check (benign class, confirms the mechanism fires):**\n```java\nstatic class SafeThing implements Comparable\u003cSafeThing\u003e {\n    public String name;\n    public SafeThing() {}\n    public int compareTo(SafeThing o) { return 0; }\n}\nstatic class Holder {\n    @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)\n    public Comparable\u003c?\u003e value;\n}\n\nObjectMapper mapper = JsonMapper.builder().build();   // no custom PTV\nString json = \"{\\\"value\\\":{\\\"@class\\\":\\\"...SafeThing\\\",\\\"name\\\":\\\"hello\\\"}}\";\nHolder h = mapper.readValue(json, Holder.class);\n// RESULT: ACCEPTED, class=...SafeThing\n```\n\n**2. Real JDK class substitution:**\n```java\nString json = \"{\\\"value\\\":[\\\"java.io.File\\\",\\\"/etc/passwd\\\"]}\";\nHolder h = mapper.readValue(json, Holder.class);\n// RESULT: ACCEPTED, class=java.io.File value=/etc/passwd\n```\n\n**3. Negative control — Default Typing with an explicit custom PTV:**\n```java\nPolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()\n    .allowIfSubType(\"PtvGapTest4\").build();\nObjectMapper mapper = JsonMapper.builder()\n    .activateDefaultTyping(ptv, DefaultTyping.NON_FINAL).build();\n// same java.io.File payload\n// RESULT: REJECTED - InvalidTypeIdException: \"...denied resolution\"\n```\n\n**Observed output:**\n\n\n\n\n$ java -cp .:build/classes PtvGapTest3\nTrying: {\"value\":[\"java.io.File\",\"/etc/passwd\"]}\nACCEPTED, class=java.io.File value=/etc/passwd\n\n$ java -cp .:build/classes PtvGapTest4\nTrying malicious substitution: [\"PtvGapTest4$Holder\",{\"value\":[\"java.io.File\",\"/etc/passwd\"]}]\nREJECTED - InvalidTypeIdException: Could not resolve type id 'java.io.File' as a\nsubtype of java.lang.Comparable: Configured PolymorphicTypeValidator denied resolution\n\n\n\n\n### Impact\nAny application declaring an `@JsonTypeInfo`-annotated property or class with `Comparable` as its base type, without a separately configured restrictive `PolymorphicTypeValidator`, will accept a type identifier for essentially any class implementing `Comparable`. Concrete impact is demonstrated via `java.io.File`: an attacker can cause construction of a `File` object for an arbitrary, attacker-chosen path. On its own this is a controlled-object-instantiation primitive; if the application later calls path-sensitive or mutating methods on the received value, this becomes a path-traversal-adjacent primitive. \n\n**Suggested remediation:**\n1. Add `java.lang.Comparable` to `UnsafeBaseTypes.UNSAFE`.\n2. Audit other broad JDK interfaces (`java.lang.Iterable`, `java.util.EventListener`) for the same gap.\n3. Consider a narrower default for `isSafeSubType()` for base types outside the fixed denylist, rather than unconditional `true`.","status":"published","published":"2026-09-28T20:44:25Z","modified":"2026-09-28T21:00:05.608227628Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-502","CWE-915"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"RHLW-2026-09128b29f89dc8ed","title":"Lightwell Security Advisory: jackson-databind 2.17.3.rhlw-00013","description":"Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.17.3.rhlw-00013 with backported fixes for CVE-2026-83557, CVE-2026-54512, CVE-2026-54515, CVE-2026-19032, CVE-2026-77310, CVE-2026-54514, CVE-2026-59888, and CVE-2026-54513.\n\nCVE-2026-83557: jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types\n\nCVE-2026-54512: jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation\n\nCVE-2026-54515: jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties\n\nCVE-2026-19032: jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path\n\nCVE-2026-77310: jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)\n\nCVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)\n\nCVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy\n\nCVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)\n\nThis patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.17.3 from Maven Central.","status":"published","published":"2026-09-23T15:56:22Z","modified":"2026-10-27T04:12:59.117996426Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-804d65df1a73952a","title":"Lightwell Security Advisory: jackson-databind 2.18.0.rhlw-00010","description":"Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.18.0.rhlw-00010 with backported fixes for CVE-2026-19032, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, CVE-2026-59889, and CVE-2026-83557.\n\nCVE-2026-19032: jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path\n\nCVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)\n\nCVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)\n\nCVE-2026-54515: jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties\n\nCVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy\n\nCVE-2026-59889: jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization\n\nCVE-2026-83557: jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types\n\nThis patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.18.0 from Maven Central.","status":"published","published":"2026-09-16T12:33:26Z","modified":"2026-10-27T04:13:02.989872193Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.","status":"published","published":"2026-09-01T15:17:00Z","modified":"2026-10-17T13:01:11.954085962Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"CLSA-2026-1789307500","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.17.3-tuxcare.2.","status":"published","published":"2026-09-13T13:51:40Z","modified":"2026-10-15T09:47:43.105450919Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789494210","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.2-tuxcare.1.","status":"published","published":"2026-09-15T17:43:30Z","modified":"2026-10-15T09:47:43.884727214Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1791545828","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.17.1-tuxcare.1.","status":"published","published":"2026-10-09T11:37:08Z","modified":"2026-10-15T09:47:45.281986412Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791781917","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.13.4.2-tuxcare.1.","status":"published","published":"2026-10-12T05:11:57Z","modified":"2026-10-15T09:47:45.434909078Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792441007","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.15.0-tuxcare.1.","status":"published","published":"2026-10-19T20:16:47Z","modified":"2026-10-20T01:45:02.666970276Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792441009","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.13.4-tuxcare.1.","status":"published","published":"2026-10-19T20:16:49Z","modified":"2026-10-20T01:45:02.670925722Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792441229","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.14.3-tuxcare.1.","status":"published","published":"2026-10-19T20:20:29Z","modified":"2026-10-20T01:45:05.539513923Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792441426","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.4-tuxcare.1.","status":"published","published":"2026-10-19T20:23:46Z","modified":"2026-10-20T01:45:04.432952872Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792441448","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.3-tuxcare.1.","status":"published","published":"2026-10-19T20:24:08Z","modified":"2026-10-20T01:45:03.627926753Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792441664","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.2-tuxcare.1.","status":"published","published":"2026-10-19T20:27:44Z","modified":"2026-10-20T01:45:02.661348231Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792475167","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.16.1-tuxcare.1.","status":"published","published":"2026-10-20T05:46:07Z","modified":"2026-10-20T07:15:05.273214174Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792478714","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.13.5-tuxcare.1.","status":"published","published":"2026-10-20T06:45:14Z","modified":"2026-10-20T13:45:05.855153469Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479357","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.2-tuxcare.3.","status":"published","published":"2026-10-20T06:55:57Z","modified":"2026-10-22T14:30:58.973677104Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792516705","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.16.0-tuxcare.1.","status":"published","published":"2026-10-20T17:18:25Z","modified":"2026-10-20T19:30:06.493571349Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792517919","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.17.0-tuxcare.1.","status":"published","published":"2026-10-20T17:38:39Z","modified":"2026-10-20T19:30:06.480905637Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792517950","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.16.2-tuxcare.1.","status":"published","published":"2026-10-20T17:39:10Z","modified":"2026-10-20T19:30:06.38058255Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792517982","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.1-tuxcare.1.","status":"published","published":"2026-10-20T17:39:42Z","modified":"2026-10-20T19:30:06.379447907Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1793200760","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.1-tuxcare.2.","status":"published","published":"2026-10-28T15:19:20Z","modified":"2026-10-28T19:45:06.951694976Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793208270","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.11.1-tuxcare.3.","status":"published","published":"2026-10-28T17:24:30Z","modified":"2026-10-28T19:45:05.116496067Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793208938","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.1-tuxcare.3.","status":"published","published":"2026-10-28T17:35:38Z","modified":"2026-10-28T19:45:02.440351013Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209495","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.11.0-tuxcare.2.","status":"published","published":"2026-10-28T17:44:55Z","modified":"2026-10-28T19:45:06.945724365Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793273384","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.12.6.1-tuxcare.3.","status":"published","published":"2026-10-29T11:29:44Z","modified":"2026-10-29T13:45:02.583652093Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793274468","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.12.6-tuxcare.2.","status":"published","published":"2026-10-29T11:47:48Z","modified":"2026-10-29T13:45:02.564232673Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793274960","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.7-tuxcare.3.","status":"published","published":"2026-10-29T11:56:00Z","modified":"2026-10-29T13:45:04.39617026Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793295575","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.13.0-tuxcare.3.","status":"published","published":"2026-10-29T18:39:37Z","modified":"2026-10-30T02:15:04.44483641Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793348493","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.19.0-tuxcare.2.","status":"published","published":"2026-10-30T09:21:34Z","modified":"2026-10-30T13:30:10.684286013Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793348823","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.11.4-tuxcare.3.","status":"published","published":"2026-10-30T09:27:03Z","modified":"2026-10-30T13:30:10.176512628Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793348906","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.11.3-tuxcare.4.","status":"published","published":"2026-10-30T09:28:27Z","modified":"2026-10-30T13:30:09.833335872Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793349274","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.20.1-tuxcare.3.","status":"published","published":"2026-10-30T09:34:34Z","modified":"2026-10-30T13:30:10.692276119Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793349383","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.4-tuxcare.3.","status":"published","published":"2026-10-30T09:36:23Z","modified":"2026-10-30T13:30:10.689213278Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793362223","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.18.4-tuxcare.3.","status":"published","published":"2026-10-30T13:10:24Z","modified":"2026-10-30T19:45:51.105826586Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793363147","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.13.1-tuxcare.3.","status":"published","published":"2026-10-30T13:25:48Z","modified":"2026-10-30T19:45:49.282896801Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793522726","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.12.2-tuxcare.3.","status":"published","published":"2026-11-01T09:45:27Z","modified":"2026-11-01T14:30:03.858720441Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793531937","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.21.4-tuxcare.2.","status":"published","published":"2026-11-01T12:18:58Z","modified":"2026-11-01T20:15:02.602323304Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793532239","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.19.4-tuxcare.2.","status":"published","published":"2026-11-01T12:24:00Z","modified":"2026-11-01T20:15:04.391962195Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793532432","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.5-tuxcare.3.","status":"published","published":"2026-11-01T12:27:13Z","modified":"2026-11-01T20:15:02.59986879Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793532868","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.19.2-tuxcare.2.","status":"published","published":"2026-11-01T12:34:28Z","modified":"2026-11-01T20:15:02.604257204Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793533147","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.13.2.2-tuxcare.3.","status":"published","published":"2026-11-01T12:39:08Z","modified":"2026-11-01T20:15:05.184698248Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793544702","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.7.1-tuxcare.4.","status":"published","published":"2026-11-01T15:51:43Z","modified":"2026-11-01T20:15:03.883823696Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793544811","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.13.3-tuxcare.2.","status":"published","published":"2026-11-01T15:53:32Z","modified":"2026-11-01T20:15:02.596224607Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793544907","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.11.2-tuxcare.2.","status":"published","published":"2026-11-01T15:55:08Z","modified":"2026-11-01T20:15:04.390537646Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793866208","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (11 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 11 CVEs. Fixed in 2.8.7-tuxcare.6.","status":"published","published":"2026-11-05T09:10:09Z","modified":"2026-11-05T13:15:03.277963123Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793866335","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (11 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 11 CVEs. Fixed in 2.7.8-tuxcare.5.","status":"published","published":"2026-11-05T09:12:16Z","modified":"2026-11-05T13:15:04.033362628Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793866444","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.7.0-tuxcare.4.","status":"published","published":"2026-11-05T09:14:05Z","modified":"2026-11-05T13:15:02.300438265Z","updated_at":"2026-11-05T13:30:00.949926Z"}]},"sources_more":{"osv":49}}