{"id":"CVE-2026-91776","aliases":["CLSA-2026-1791487635","CLSA-2026-1792441729","CLSA-2026-1792441919","CLSA-2026-1792441992","CLSA-2026-1792479357","CLSA-2026-1793200513","CLSA-2026-1793200647","CLSA-2026-1793201235","CLSA-2026-1793207967","CLSA-2026-1793208072","CLSA-2026-1793208167","CLSA-2026-1793208270","CLSA-2026-1793208638","CLSA-2026-1793208732","CLSA-2026-1793208938","CLSA-2026-1793209037","CLSA-2026-1793209495","CLSA-2026-1793209588","CLSA-2026-1793209672","CLSA-2026-1793209760","CLSA-2026-1793209895","CLSA-2026-1793214775","CLSA-2026-1793260179","CLSA-2026-1793260214","CLSA-2026-1793260230","CLSA-2026-1793260240","CLSA-2026-1793260371","CLSA-2026-1793273163","CLSA-2026-1793273322","CLSA-2026-1793273384","CLSA-2026-1793274003","CLSA-2026-1793274225","CLSA-2026-1793274468","CLSA-2026-1793274500","CLSA-2026-1793274960","CLSA-2026-1793287973","CLSA-2026-1793288062","CLSA-2026-1793288185","CLSA-2026-1793288285","CLSA-2026-1793288379","CLSA-2026-1793288485","CLSA-2026-1793288575","CLSA-2026-1793288673","CLSA-2026-1793294610","CLSA-2026-1793294643","CLSA-2026-1793295217","CLSA-2026-1793295274","CLSA-2026-1793295302","CLSA-2026-1793295362","CLSA-2026-1793295423","CLSA-2026-1793295575","CLSA-2026-1793348457","CLSA-2026-1793348493","CLSA-2026-1793348626","CLSA-2026-1793349010","CLSA-2026-1793349274","CLSA-2026-1793349383","CLSA-2026-1793349650","CLSA-2026-1793361197","CLSA-2026-1793362140","CLSA-2026-1793362223","CLSA-2026-1793362246","CLSA-2026-1793362272","CLSA-2026-1793362367","CLSA-2026-1793363087","CLSA-2026-1793363126","CLSA-2026-1793520322","CLSA-2026-1793520513","CLSA-2026-1793520709","CLSA-2026-1793521072","CLSA-2026-1793521151","CLSA-2026-1793521240","CLSA-2026-1793521464","CLSA-2026-1793521537","CLSA-2026-1793521766","CLSA-2026-1793522050","CLSA-2026-1793522157","CLSA-2026-1793522232","CLSA-2026-1793522383","CLSA-2026-1793522726","CLSA-2026-1793530637","CLSA-2026-1793530725","CLSA-2026-1793531058","CLSA-2026-1793531790","CLSA-2026-1793532071","CLSA-2026-1793532239","CLSA-2026-1793532508","CLSA-2026-1793532613","CLSA-2026-1793532868","DEBIAN-CVE-2026-91776","EUVD-2026-85002","GHSA-mhm7-754m-9p8w","GHSA-wv8q-qhhj-9h54","RHLW-2026-bcaf0a0ae0978229","ROOT-APP-MAVEN-CVE-2026-91776","SUSE-SU-2026:24149-1","SUSE-SU-2026:4394-1","UBUNTU-CVE-2026-91776","openSUSE-SU-2026:11877-1","openSUSE-SU-2026:22034-1"],"aliases_more":12,"status":"published","title":"jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00487,"percentile":0.42256,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-09-23T02:17:50Z","modified":"2026-11-06T13:28:06Z","fixes":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.18.11","2.21.7","2.22.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","fixed_in":["3.1.7","3.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"jackson-databind","fixed_in":["2.18.11-1"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.13.4.2-rhlw-00004"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.18.9-aikido.1","2.18.9-aikido.2","2.21.5-aikido.3","2.13.3-aikido.7","2.12.7.1-aikido.3","2.21.4-aikido.2","2.14.2-aikido.4","2.22.1-aikido.1","2.21.1-aikido.4","2.13.4.2-aikido.3","2.12.6.1-aikido.2","2.12.7-aikido.2","2.13.2.2-aikido.5","2.18.1-aikido.4","2.17.2-aikido.6","2.16.0-aikido.3","2.17.1-aikido.3","2.19.1-aikido.2","2.21.2-aikido.4","2.19.4-aikido.5","2.21.3-aikido.3","2.20.0-aikido.4","2.18.10-aikido.1","2.15.2-aikido.4","2.21.6-aikido.1","2.19.0-aikido.2","2.15.0-aikido.4","2.16.2-aikido.6","2.18.8-aikido.2","2.18.2-aikido.4","2.22.2-aikido.1","2.22.1-aikido.2","2.19.0-aikido.3","2.18.3-aikido.5","2.21.2-aikido.5","2.19.1-aikido.3","2.22.0-aikido.1","2.13.5-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-databind","fixed_in":["3.1.5-aikido.3","3.1.4-aikido.2","3.1.6-aikido.1","3.1.4-aikido.3","3.1.5-aikido.4","3.1.4-aikido.4","3.2.2-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.18.9-root.io.1","2.18.9-root.io.2","2.21.5-root.io.3","2.13.3-root.io.7","2.12.7.1-root.io.3","2.21.4-root.io.2","2.14.2-root.io.4","2.22.1-root.io.1","2.21.1-root.io.4","2.13.4.2-root.io.3","2.12.6.1-root.io.2","2.12.7-root.io.2","2.13.2.2-root.io.5","2.18.1-root.io.4","2.17.2-root.io.6","2.16.0-root.io.3","2.17.1-root.io.3","2.19.1-root.io.2","2.21.2-root.io.4","2.19.4-root.io.5","2.21.3-root.io.3","2.20.0-root.io.4","2.18.10-root.io.1","2.15.2-root.io.4","2.21.6-root.io.1","2.19.0-root.io.2","2.15.0-root.io.4","2.16.2-root.io.6","2.18.8-root.io.2","2.18.2-root.io.4","2.22.2-root.io.1","2.22.1-root.io.2","2.19.0-root.io.3","2.18.3-root.io.5","2.21.2-root.io.5","2.19.1-root.io.3","2.22.0-root.io.1","2.13.5-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-databind","fixed_in":["3.1.5-root.io.3","3.1.4-root.io.2","3.1.6-root.io.1","3.1.4-root.io.3","3.1.5-root.io.4","3.1.4-root.io.4","3.2.2-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"last_affected":"2.18.10"},{"fixed":"2.18.11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"last_affected":"2.21.6"},{"fixed":"2.21.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"last_affected":"2.22.2"},{"fixed":"2.22.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.1.6"},{"fixed":"3.1.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"last_affected":"3.2.2"},{"fixed":"3.2.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.3"},{"fixed":"2.17.3-tuxcare.3"}]}],"versions":["2.17.3","2.17.3-tuxcare.1","2.17.3-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.4"},{"fixed":"2.21.4-tuxcare.1"}]}],"versions":["2.21.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.8"},{"fixed":"2.18.8-tuxcare.1"}]}],"versions":["2.18.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.2"},{"fixed":"2.17.2-tuxcare.2"}]}],"versions":["2.17.2","2.17.2-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.2"},{"fixed":"2.14.2-tuxcare.3"}]}],"versions":["2.14.2","2.14.2-tuxcare.1","2.14.2-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.8"},{"fixed":"2.7.8-tuxcare.2"}]}],"versions":["2.7.8","2.7.8-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.5.1"},{"fixed":"2.10.5.1-tuxcare.2"}]}],"versions":["2.10.5.1","2.10.5.1-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.2"},{"fixed":"2.21.2-tuxcare.1"}]}],"versions":["2.21.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7.1"},{"fixed":"2.6.7.1-tuxcare.2"}]}],"versions":["2.6.7.1","2.6.7.1-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.4"},{"fixed":"2.5.4-tuxcare.2"}]}],"versions":["2.5.4","2.5.4-tuxcare.1"],"bundled":30},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.3"},{"fixed":"2.6.3-tuxcare.2"}]}],"versions":["2.6.3","2.6.3-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.1"},{"fixed":"2.11.1-tuxcare.3"}]}],"versions":["2.11.1","2.11.1-tuxcare.1","2.11.1-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.5"},{"fixed":"2.12.5-tuxcare.2"}]}],"versions":["2.12.5","2.12.5-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.1"},{"fixed":"2.13.1-tuxcare.2"}]}],"versions":["2.13.1","2.13.1-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.3"}]}],"versions":["2.12.1","2.12.1-tuxcare.1","2.12.1-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.2.2"},{"fixed":"2.13.2.2-tuxcare.2"}]}],"versions":["2.13.2.2","2.13.2.2-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.0-tuxcare.2"}]}],"versions":["2.11.0","2.11.0-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.3"},{"fixed":"2.11.3-tuxcare.3"}]}],"versions":["2.11.3","2.11.3-tuxcare.1","2.11.3-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.6"},{"fixed":"2.6.6-tuxcare.2"}]}],"versions":["2.6.6","2.6.6-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.10"},{"fixed":"2.8.10-tuxcare.2"}]}],"versions":["2.8.10","2.8.10-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.4"},{"fixed":"2.13.4-tuxcare.2"}]}],"versions":["2.13.4","2.13.4-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.8"},{"fixed":"2.9.10.8-tuxcare.2"}]}],"versions":["2.9.10.8","2.9.10.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.4"},{"fixed":"2.11.4-tuxcare.2"}]}],"versions":["2.11.4","2.11.4-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9.7"},{"fixed":"2.7.9.7-tuxcare.2"}]}],"versions":["2.7.9.7","2.7.9.7-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.2"},{"fixed":"2.10.2-tuxcare.2"}]}],"versions":["2.10.2","2.10.2-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.2"},{"fixed":"2.9.2-tuxcare.2"}]}],"versions":["2.9.2","2.9.2-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3"},{"fixed":"2.10.3-tuxcare.2"}]}],"versions":["2.10.3","2.10.3-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10"},{"fixed":"2.9.10-tuxcare.2"}]}],"versions":["2.9.10","2.9.10-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.8"},{"fixed":"2.9.8-tuxcare.2"}]}],"versions":["2.9.8","2.9.8-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.6.1"},{"fixed":"2.12.6.1-tuxcare.3"}]}],"versions":["2.12.6.1","2.12.6.1-tuxcare.1","2.12.6.1-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9.1"},{"fixed":"2.9.9.1-tuxcare.2"}]}],"versions":["2.9.9.1","2.9.9.1-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.7"},{"fixed":"2.8.7-tuxcare.4"}]}],"versions":["2.8.7","2.8.7-tuxcare.1","2.8.7-tuxcare.2","2.8.7-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.6"},{"fixed":"2.12.6-tuxcare.2"}]}],"versions":["2.12.6","2.12.6-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.3"},{"fixed":"2.9.10.3-tuxcare.3"}]}],"versions":["2.9.10.3","2.9.10.3-tuxcare.1","2.9.10.3-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.7"},{"fixed":"2.12.7-tuxcare.3"}]}],"versions":["2.12.7","2.12.7-tuxcare.1","2.12.7-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1"},{"fixed":"2.7.1-tuxcare.3"}]}],"versions":["2.7.1","2.7.1-tuxcare.1","2.7.1-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.4"},{"fixed":"2.8.4-tuxcare.3"}]}],"versions":["2.8.4","2.8.4-tuxcare.1","2.8.4-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.2"}]}],"versions":["2.7.9","2.7.9-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.5"},{"fixed":"2.8.5-tuxcare.3"}]}],"versions":["2.8.5","2.8.5-tuxcare.1","2.8.5-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.1"},{"fixed":"2.8.11.1-tuxcare.2"}]}],"versions":["2.8.11.1","2.8.11.1-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.7"},{"fixed":"2.9.7-tuxcare.2"}]}],"versions":["2.9.7","2.9.7-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.5"},{"fixed":"2.7.5-tuxcare.2"}]}],"versions":["2.7.5","2.7.5-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.3"},{"fixed":"2.9.3-tuxcare.3"}]}],"versions":["2.9.3","2.9.3-tuxcare.1","2.9.3-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5"},{"fixed":"2.4.5-tuxcare.2"}]}],"versions":["2.4.5","2.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11"},{"fixed":"2.8.11-tuxcare.2"}]}],"versions":["2.8.11","2.8.11-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.1"},{"fixed":"2.4.1-tuxcare.2"}]}],"versions":["2.4.1","2.4.1-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7.3"},{"fixed":"2.6.7.3-tuxcare.3"}]}],"versions":["2.6.7.3","2.6.7.3-tuxcare.1","2.6.7.3-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.3"},{"fixed":"2.4.3-tuxcare.2"}]}],"versions":["2.4.3","2.4.3-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7.2"},{"fixed":"2.6.7.2-tuxcare.3"}]}],"versions":["2.6.7.2","2.6.7.2-tuxcare.1","2.6.7.2-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.4"},{"fixed":"2.9.4-tuxcare.2"}]}],"versions":["2.9.4","2.9.4-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.13.0-tuxcare.3"}]}],"versions":["2.13.0","2.13.0-tuxcare.1","2.13.0-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.2"},{"fixed":"2.15.2-tuxcare.3"}]}],"versions":["2.15.2","2.15.2-tuxcare.1","2.15.2-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.19.0-tuxcare.2"}]}],"versions":["2.19.0","2.19.0-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.3"},{"fixed":"2.15.3-tuxcare.3"}]}],"versions":["2.15.3","2.15.3-tuxcare.1","2.15.3-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2"},{"fixed":"3.1.2-tuxcare.1"}]}],"versions":["3.1.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.1"},{"fixed":"2.20.1-tuxcare.3"}]}],"versions":["2.20.1","2.20.1-tuxcare.1","2.20.1-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.4"},{"fixed":"2.12.4-tuxcare.3"}]}],"versions":["2.12.4","2.12.4-tuxcare.1","2.12.4-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.1"},{"fixed":"2.16.1-tuxcare.2"}]}],"versions":["2.16.1","2.16.1-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.4"},{"fixed":"2.10.4-tuxcare.3"}]}],"versions":["2.10.4","2.10.4-tuxcare.1","2.10.4-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.7"},{"fixed":"2.9.10.7-tuxcare.3"}]}],"versions":["2.9.10.7","2.9.10.7-tuxcare.1","2.9.10.7-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.4"},{"fixed":"2.18.4-tuxcare.3"}]}],"versions":["2.18.4","2.18.4-tuxcare.1","2.18.4-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.2"},{"fixed":"2.16.2-tuxcare.3"}]}],"versions":["2.16.2","2.16.2-tuxcare.1","2.16.2-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.1"},{"fixed":"2.15.1-tuxcare.3"}]}],"versions":["2.15.1","2.15.1-tuxcare.1","2.15.1-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.0"},{"fixed":"2.15.0-tuxcare.2"}]}],"versions":["2.15.0","2.15.0-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.4"},{"fixed":"2.15.4-tuxcare.4"}]}],"versions":["2.15.4","2.15.4-tuxcare.1","2.15.4-tuxcare.2","2.15.4-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.5"},{"fixed":"2.18.5-tuxcare.3"}]}],"versions":["2.18.5","2.18.5-tuxcare.1","2.18.5-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.4"},{"fixed":"2.9.10.4-tuxcare.3"}]}],"versions":["2.9.10.4","2.9.10.4-tuxcare.1","2.9.10.4-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.3"},{"fixed":"2.8.11.3-tuxcare.2"}]}],"versions":["2.8.11.3","2.8.11.3-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1-tuxcare.2"}]}],"versions":["2.9.1","2.9.1-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9.3"},{"fixed":"2.7.9.3-tuxcare.3"}]}],"versions":["2.7.9.3","2.7.9.3-tuxcare.1","2.7.9.3-tuxcare.2"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9"},{"fixed":"2.9.9-tuxcare.2"}]}],"versions":["2.9.9","2.9.9-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9.3"},{"fixed":"2.9.9.3-tuxcare.2"}]}],"versions":["2.9.9.3","2.9.9.3-tuxcare.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.4"},{"fixed":"2.8.11.4-tuxcare.2"}]}],"versions":["2.8.11.4","2.8.11.4-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.5"},{"fixed":"2.9.5-tuxcare.2"}]}],"versions":["2.9.5","2.9.5-tuxcare.1"],"bundled":19},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.4"},{"fixed":"2.6.4-tuxcare.2"}]}],"versions":["2.6.4","2.6.4-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.3"},{"fixed":"2.7.3-tuxcare.3"}]}],"versions":["2.7.3","2.7.3-tuxcare.1","2.7.3-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.18.0-tuxcare.3"}]}],"versions":["2.18.0","2.18.0-tuxcare.1","2.18.0-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.1"},{"fixed":"2.9.10.1-tuxcare.2"}]}],"versions":["2.9.10.1","2.9.10.1-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.2"},{"fixed":"2.18.2-tuxcare.2"}]}],"versions":["2.18.2","2.18.2-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.2"},{"fixed":"2.12.2-tuxcare.3"}]}],"versions":["2.12.2","2.12.2-tuxcare.1","2.12.2-tuxcare.2"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.5"},{"fixed":"2.6.5-tuxcare.3"}]}],"versions":["2.6.5","2.6.5-tuxcare.1","2.6.5-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.1.1"},{"fixed":"2.4.1.1-tuxcare.3"}]}],"versions":["2.4.1.1","2.4.1.1-tuxcare.1","2.4.1.1-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.0"},{"fixed":"2.16.0-tuxcare.4"}]}],"versions":["2.16.0","2.16.0-tuxcare.1","2.16.0-tuxcare.2","2.16.0-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0"},{"fixed":"2.17.0-tuxcare.2"}]}],"versions":["2.17.0","2.17.0-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.4.2"},{"fixed":"2.13.4.2-tuxcare.3"}]}],"versions":["2.13.4.2","2.13.4.2-tuxcare.1","2.13.4.2-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.4"},{"fixed":"2.19.4-tuxcare.2"}]}],"versions":["2.19.4","2.19.4-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.5"},{"fixed":"2.13.5-tuxcare.3"}]}],"versions":["2.13.5","2.13.5-tuxcare.1","2.13.5-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.1"},{"fixed":"2.17.1-tuxcare.4"}]}],"versions":["2.17.1","2.17.1-tuxcare.1","2.17.1-tuxcare.2","2.17.1-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.2"},{"fixed":"2.19.2-tuxcare.2"}]}],"versions":["2.19.2","2.19.2-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.1"},{"fixed":"2.14.1-tuxcare.3"}]}],"versions":["2.14.1","2.14.1-tuxcare.1","2.14.1-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.6"},{"fixed":"2.9.10.6-tuxcare.2"}]}],"versions":["2.9.10.6","2.9.10.6-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.0-tuxcare.3"}]}],"versions":["2.4.0","2.4.0-tuxcare.1","2.4.0-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.0-tuxcare.3"}]}],"versions":["2.7.0","2.7.0-tuxcare.1","2.7.0-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.7.1"},{"fixed":"2.12.7.1-tuxcare.4"}]}],"versions":["2.12.7.1","2.12.7.1-tuxcare.1","2.12.7.1-tuxcare.2","2.12.7.1-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.3"},{"fixed":"2.13.3-tuxcare.2"}]}],"versions":["2.13.3","2.13.3-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.2"},{"fixed":"2.11.2-tuxcare.2"}]}],"versions":["2.11.2","2.11.2-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.5"},{"fixed":"2.9.10.5-tuxcare.2"}]}],"versions":["2.9.10.5","2.9.10.5-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.3"},{"fixed":"2.14.3-tuxcare.2"}]}],"versions":["2.14.3","2.14.3-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.3"},{"fixed":"2.18.3-tuxcare.5"}]}],"versions":["2.18.3","2.18.3-tuxcare.1","2.18.3-tuxcare.2","2.18.3-tuxcare.3","2.18.3-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.4"},{"fixed":"2.1.4-tuxcare.2"}]}],"versions":["2.1.4","2.1.4-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.3"},{"fixed":"2.2.3-tuxcare.3"}]}],"versions":["2.2.3","2.2.3-tuxcare.1","2.2.3-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-2","2.14.0+ds-3","2.14.0-1","2.14.0-1+deb12u1","2.18.11-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-1+deb13u1","2.14.0+ds-2","2.14.0+ds-3","2.18.11-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-1"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-2","2.14.0+ds-3"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.18.11"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.0.6","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.5.1","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1","2.13.2.2","2.13.3","2.13.4","2.13.4.1","2.13.4.2","2.13.5","2.14.0","2.14.0-rc1","2.14.0-rc2","2.14.0-rc3","2.14.1","2.14.2","2.14.3","2.15.0","2.15.0-rc1","2.15.0-rc2","2.15.0-rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0-rc1","2.16.1","2.16.2","2.17.0","2.17.0-rc1","2.17.1","2.17.2","2.17.3","2.18.0","2.18.0-rc1","2.18.1","2.18.10","2.18.2","2.18.3","2.18.4","2.18.5","2.18.6","2.18.7","2.18.8","2.18.9","2.2.0","2.2.0-rc1","2.2.1","2.2.2","2.2.3","2.2.4","2.3.0","2.3.0-rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.0-rc1","2.4.0-rc2","2.4.0-rc3","2.4.1","2.4.1.1","2.4.1.2","2.4.1.3","2.4.2","2.4.3","2.4.4","2.4.5","2.4.5.1","2.4.6","2.4.6.1","2.5.0","2.5.0-rc1","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.0","2.6.0-rc1","2.6.0-rc2","2.6.0-rc3","2.6.0-rc4","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.7.1","2.6.7.2","2.6.7.3","2.6.7.4","2.6.7.5","2.7.0","2.7.0-rc1","2.7.0-rc2","2.7.0-rc3","2.7.1","2.7.1-1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.7.9.1","2.7.9.2","2.7.9.3","2.7.9.4","2.7.9.5","2.7.9.6","2.7.9.7","2.8.0","2.8.0.rc1","2.8.0.rc2","2.8.1","2.8.10","2.8.11","2.8.11.1","2.8.11.2","2.8.11.3","2.8.11.4","2.8.11.5","2.8.11.6","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.8.1","2.8.9","2.9.0","2.9.0.pr1","2.9.0.pr2","2.9.0.pr3","2.9.0.pr4","2.9.1","2.9.10","2.9.10.1","2.9.10.2","2.9.10.3","2.9.10.4","2.9.10.5","2.9.10.6","2.9.10.7","2.9.10.8","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2.9.9.1","2.9.9.2","2.9.9.3"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.21.7"}]}],"versions":["2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.0-rc1","2.20.1","2.20.2","2.21.0","2.21.1","2.21.2","2.21.3","2.21.4","2.21.5","2.21.6"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"fixed":"2.22.3"}]}],"versions":["2.22.0","2.22.1","2.22.2"]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.7"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6"]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.3"}]}],"versions":["3.2.0","3.2.1","3.2.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.4.2-rhlw-00004"}]}],"versions":["2.0.0","2.0.0-RC1","2.0.0-RC2","2.0.0-RC3","2.0.1","2.0.2","2.0.4","2.0.5","2.0.6","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.5.1","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1","2.13.2.2","2.13.3","2.13.4","2.13.4.1","2.13.4.2","2.2.0","2.2.0-rc1","2.2.1","2.2.2","2.2.3","2.2.4","2.3.0","2.3.0-rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.0-rc1","2.4.0-rc2","2.4.0-rc3","2.4.1","2.4.1.1","2.4.1.2","2.4.1.3","2.4.2","2.4.3","2.4.4","2.4.5","2.4.5.1","2.4.6","2.4.6.1","2.5.0","2.5.0-rc1","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.0","2.6.0-rc1","2.6.0-rc2","2.6.0-rc3","2.6.0-rc4","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.7.1","2.6.7.2","2.6.7.3","2.6.7.4","2.6.7.5","2.7.0","2.7.0-rc1","2.7.0-rc2","2.7.0-rc3","2.7.1","2.7.1-1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.7.9.1","2.7.9.2","2.7.9.3","2.7.9.4","2.7.9.5","2.7.9.6","2.7.9.7","2.8.0","2.8.0.rc1","2.8.0.rc2","2.8.1","2.8.10","2.8.11","2.8.11.1","2.8.11.2","2.8.11.3","2.8.11.4","2.8.11.5","2.8.11.6","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.8.1","2.8.9","2.9.0","2.9.0.pr1","2.9.0.pr2","2.9.0.pr3","2.9.0.pr4","2.9.1","2.9.10","2.9.10.1","2.9.10.2","2.9.10.3","2.9.10.4","2.9.10.5","2.9.10.6","2.9.10.7","2.9.10.8","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2.9.9.1","2.9.9.2","2.9.9.3"]},{"source":"osv","ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-aikido.1"},{"fixed":"2.18.9-aikido.2"},{"fixed":"2.21.5-aikido.3"},{"fixed":"2.13.3-aikido.7"},{"fixed":"2.12.7.1-aikido.3"},{"fixed":"2.21.4-aikido.2"},{"fixed":"2.14.2-aikido.4"},{"fixed":"2.22.1-aikido.1"},{"fixed":"2.21.1-aikido.4"},{"fixed":"2.13.4.2-aikido.3"},{"fixed":"2.12.6.1-aikido.2"},{"fixed":"2.12.7-aikido.2"},{"fixed":"2.13.2.2-aikido.5"},{"fixed":"2.18.1-aikido.4"},{"fixed":"2.17.2-aikido.6"},{"fixed":"2.16.0-aikido.3"},{"fixed":"2.17.1-aikido.3"},{"fixed":"2.19.1-aikido.2"},{"fixed":"2.21.2-aikido.4"},{"fixed":"2.19.4-aikido.5"},{"fixed":"2.21.3-aikido.3"},{"fixed":"2.20.0-aikido.4"},{"fixed":"2.18.10-aikido.1"},{"fixed":"2.15.2-aikido.4"},{"fixed":"2.21.6-aikido.1"},{"fixed":"2.19.0-aikido.2"},{"fixed":"2.15.0-aikido.4"},{"fixed":"2.16.2-aikido.6"},{"fixed":"2.18.8-aikido.2"},{"fixed":"2.18.2-aikido.4"},{"fixed":"2.22.2-aikido.1"},{"fixed":"2.22.1-aikido.2"},{"fixed":"2.19.0-aikido.3"},{"fixed":"2.18.3-aikido.5"},{"fixed":"2.21.2-aikido.5"},{"fixed":"2.19.1-aikido.3"},{"fixed":"2.22.0-aikido.1"},{"fixed":"2.13.5-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-aikido.3"},{"fixed":"3.1.4-aikido.2"},{"fixed":"3.1.6-aikido.1"},{"fixed":"3.1.4-aikido.3"},{"fixed":"3.1.5-aikido.4"},{"fixed":"3.1.4-aikido.4"},{"fixed":"3.2.2-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-root.io.1"},{"fixed":"2.18.9-root.io.2"},{"fixed":"2.21.5-root.io.3"},{"fixed":"2.13.3-root.io.7"},{"fixed":"2.12.7.1-root.io.3"},{"fixed":"2.21.4-root.io.2"},{"fixed":"2.14.2-root.io.4"},{"fixed":"2.22.1-root.io.1"},{"fixed":"2.21.1-root.io.4"},{"fixed":"2.13.4.2-root.io.3"},{"fixed":"2.12.6.1-root.io.2"},{"fixed":"2.12.7-root.io.2"},{"fixed":"2.13.2.2-root.io.5"},{"fixed":"2.18.1-root.io.4"},{"fixed":"2.17.2-root.io.6"},{"fixed":"2.16.0-root.io.3"},{"fixed":"2.17.1-root.io.3"},{"fixed":"2.19.1-root.io.2"},{"fixed":"2.21.2-root.io.4"},{"fixed":"2.19.4-root.io.5"},{"fixed":"2.21.3-root.io.3"},{"fixed":"2.20.0-root.io.4"},{"fixed":"2.18.10-root.io.1"},{"fixed":"2.15.2-root.io.4"},{"fixed":"2.21.6-root.io.1"},{"fixed":"2.19.0-root.io.2"},{"fixed":"2.15.0-root.io.4"},{"fixed":"2.16.2-root.io.6"},{"fixed":"2.18.8-root.io.2"},{"fixed":"2.18.2-root.io.4"},{"fixed":"2.22.2-root.io.1"},{"fixed":"2.22.1-root.io.2"},{"fixed":"2.19.0-root.io.3"},{"fixed":"2.18.3-root.io.5"},{"fixed":"2.21.2-root.io.5"},{"fixed":"2.19.1-root.io.3"},{"fixed":"2.22.0-root.io.1"},{"fixed":"2.13.5-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-root.io.3"},{"fixed":"3.1.4-root.io.2"},{"fixed":"3.1.6-root.io.1"},{"fixed":"3.1.4-root.io.3"},{"fixed":"3.1.5-root.io.4"},{"fixed":"3.1.4-root.io.4"},{"fixed":"3.2.2-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-1","2.2.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-2","2.4.2-3","2.4.2-3ubuntu0.1~esm1","2.4.2-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.6-1","2.9.1-1","2.9.4-1","2.9.5-1","2.9.8-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.9.3-1","2.10.0-2","2.10.1-1","2.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-1","2.12.5-1","2.13.0-1","2.13.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1build1","2.14.0+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10}],"products":[{"vendor":"fasterxml","product":"jackson-databind"}],"references":[{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","tags":["vendor-advisory","exploit","advisory","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/6203","tags":["patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","tags":["advisory"]},{"url":"https://repo1.maven.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-91776","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624149-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273856","tags":["report"]},{"url":"https://bugzilla.suse.com/1273857","tags":["report"]},{"url":"https://bugzilla.suse.com/1277883","tags":["report"]},{"url":"https://bugzilla.suse.com/1278008","tags":["report"]},{"url":"https://bugzilla.suse.com/1280125","tags":["report"]},{"url":"https://bugzilla.suse.com/1282491","tags":["report"]},{"url":"https://bugzilla.suse.com/1282492","tags":["report"]},{"url":"https://bugzilla.suse.com/1282505","tags":["report"]},{"url":"https://bugzilla.suse.com/1282641","tags":["report"]},{"url":"https://bugzilla.suse.com/1282645","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-83557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91777","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264394-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282639","tags":["report"]},{"url":"https://bugzilla.suse.com/1282640","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68496","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-91776","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91776","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/6203","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-91776","title":"jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.","status":"published","published":"2026-09-23T02:17:50.48Z","modified":"2026-09-23T14:03:16.129Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:19:52.773089Z"}],"euvd":[{"id":"EUVD-2026-85002","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.","status":"published","published":"2026-09-23T02:17:50Z","modified":"2026-09-23T14:03:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:00.949397Z"}],"ghsa":[{"id":"GHSA-wv8q-qhhj-9h54","title":"jackson-databind retains every unknown raw type ID ","description":"### Summary\n\nWith `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown\nraw type ID selects the same fallback deserializer but is retained as a\nseparate key in `TypeDeserializerBase._deserializers`. An attacker who can\nrepeatedly supply new unknown type IDs can grow this process-lifetime cache\nwithout a configured bound.\n\n### Details\n\nThe affected path is `TypeDeserializerBase._findDeserializer()`. After an\nunknown name-based type ID resolves to the configured fallback/default\nimplementation, jackson-databind caches the result under the attacker-provided\nraw `typeId`. Although all such IDs select the same fallback deserializer, each\nnew string remains a distinct cache key.\n\nThe behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1.\nCurrent 2.22 and 3.2 source branches retained the unbounded `_deserializers`\nmap and per-raw-ID cache write when rechecked. The earlier affected floor has\nnot been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must enable name-based polymorphism with a\n`defaultImpl` or equivalent fallback, accept attacker-influenced type IDs, and\nreuse a long-lived mapper/type deserializer across requests.\n\nSuggested correction: avoid caching each unknown raw ID when every such ID\nresolves to the same fallback, use a fallback sentinel, or use an explicitly\nbounded concurrency-safe cache. A regression should contrast many distinct\nunknown IDs with repetitions of one unknown ID across requests.\n\n### PoC\n\nConfigure a polymorphic base type with\n`@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class)` and\ndeserialize inputs containing unknown type names through the same mapper.\nInspect `TypeDeserializerBase._deserializers` after the run.\n\nOn affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce\n10,000 retained cache entries even though every input selects the same\nfallback deserializer. A matched control that repeats one unknown ID 10,000\ntimes produces one retained entry. This isolates attacker-controlled key\ncardinality from ordinary request count.\n\n### Impact\n\nWhere the stated polymorphic fallback configuration is exposed to\nattacker-influenced type IDs, distinct inputs cause incremental\nprocess-lifetime memory retention and eventual availability pressure or\ndenial of service. This is not claimed as a single-request allocation spike,\nand no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No\nconfidentiality, integrity, or code-execution impact is claimed.\n\nRequested credit: Daniel Birtwhistle","status":"published","published":"2026-09-30T15:36:55Z","modified":"2026-09-30T15:36:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.","status":"published","published":"2026-09-23T03:17:04.62Z","modified":"2026-09-24T20:43:32.537Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-91776","title":"jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.","status":"published","published":"2026-09-23T02:17:50.48Z","modified":"2026-10-28T02:30:42.370434381Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:20.269367Z"},{"id":"DEBIAN-CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.","status":"published","published":"2026-09-23T03:17:04.62Z","modified":"2026-10-20T04:00:07.46653099Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:06.410207Z"},{"id":"GHSA-wv8q-qhhj-9h54","title":"jackson-databind retains every unknown raw type ID ","description":"### Summary\n\nWith `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown\nraw type ID selects the same fallback deserializer but is retained as a\nseparate key in `TypeDeserializerBase._deserializers`. An attacker who can\nrepeatedly supply new unknown type IDs can grow this process-lifetime cache\nwithout a configured bound.\n\n### Details\n\nThe affected path is `TypeDeserializerBase._findDeserializer()`. After an\nunknown name-based type ID resolves to the configured fallback/default\nimplementation, jackson-databind caches the result under the attacker-provided\nraw `typeId`. Although all such IDs select the same fallback deserializer, each\nnew string remains a distinct cache key.\n\nThe behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1.\nCurrent 2.22 and 3.2 source branches retained the unbounded `_deserializers`\nmap and per-raw-ID cache write when rechecked. The earlier affected floor has\nnot been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must enable name-based polymorphism with a\n`defaultImpl` or equivalent fallback, accept attacker-influenced type IDs, and\nreuse a long-lived mapper/type deserializer across requests.\n\nSuggested correction: avoid caching each unknown raw ID when every such ID\nresolves to the same fallback, use a fallback sentinel, or use an explicitly\nbounded concurrency-safe cache. A regression should contrast many distinct\nunknown IDs with repetitions of one unknown ID across requests.\n\n### PoC\n\nConfigure a polymorphic base type with\n`@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class)` and\ndeserialize inputs containing unknown type names through the same mapper.\nInspect `TypeDeserializerBase._deserializers` after the run.\n\nOn affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce\n10,000 retained cache entries even though every input selects the same\nfallback deserializer. A matched control that repeats one unknown ID 10,000\ntimes produces one retained entry. This isolates attacker-controlled key\ncardinality from ordinary request count.\n\n### Impact\n\nWhere the stated polymorphic fallback configuration is exposed to\nattacker-influenced type IDs, distinct inputs cause incremental\nprocess-lifetime memory retention and eventual availability pressure or\ndenial of service. This is not claimed as a single-request allocation spike,\nand no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No\nconfidentiality, integrity, or code-execution impact is claimed.\n\nRequested credit: Daniel Birtwhistle","status":"published","published":"2026-09-30T15:36:55Z","modified":"2026-09-30T15:46:18.451708212Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"RHLW-2026-bcaf0a0ae0978229","title":"Lightwell Security Advisory: jackson-databind 2.13.4.2-rhlw-00004","description":"Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.13.4.2-rhlw-00004 with a backported security fix.\n\nCVE-2026-91776: jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID\n\nThis patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.13.4.2 from Maven Central.","status":"published","published":"2026-10-08T19:45:08Z","modified":"2026-10-27T04:00:13.852661334Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.","status":"published","published":"2026-09-23T03:17:00Z","modified":"2026-10-17T13:01:17.276488546Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:40.980117Z"},{"id":"CLSA-2026-1791487635","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.3-tuxcare.3.","status":"published","published":"2026-10-08T19:27:15Z","modified":"2026-10-15T09:47:44.885262122Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792441729","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.21.4-tuxcare.1.","status":"published","published":"2026-10-19T20:28:49Z","modified":"2026-10-20T01:45:03.629273143Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792441919","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.18.8-tuxcare.1.","status":"published","published":"2026-10-19T20:31:59Z","modified":"2026-10-20T01:45:04.932187932Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792441992","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.17.2-tuxcare.2.","status":"published","published":"2026-10-19T20:33:12Z","modified":"2026-10-20T01:45:03.627603897Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479357","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.2-tuxcare.3.","status":"published","published":"2026-10-20T06:55:57Z","modified":"2026-10-22T14:30:58.973677104Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793200513","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.7.8-tuxcare.2.","status":"published","published":"2026-10-28T15:15:13Z","modified":"2026-10-28T19:45:03.541160372Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793200647","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.10.5.1-tuxcare.2.","status":"published","published":"2026-10-28T15:17:27Z","modified":"2026-10-28T19:45:06.022060488Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793201235","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.21.2-tuxcare.1.","status":"published","published":"2026-10-28T15:27:15Z","modified":"2026-10-28T19:45:02.437154468Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793207967","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.6.7.1-tuxcare.2.","status":"published","published":"2026-10-28T17:19:27Z","modified":"2026-11-06T13:28:04.267019948Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793208072","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (31 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 31 CVEs. Fixed in 2.5.4-tuxcare.2.","status":"published","published":"2026-10-28T17:21:12Z","modified":"2026-11-06T13:28:02.042118205Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793208167","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.6.3-tuxcare.2.","status":"published","published":"2026-10-28T17:22:47Z","modified":"2026-11-06T13:28:03.636885939Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793208270","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.11.1-tuxcare.3.","status":"published","published":"2026-10-28T17:24:30Z","modified":"2026-10-28T19:45:05.116496067Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793208638","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.5-tuxcare.2.","status":"published","published":"2026-10-28T17:30:38Z","modified":"2026-10-28T19:45:04.552121483Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793208732","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.13.1-tuxcare.2.","status":"published","published":"2026-10-28T17:32:12Z","modified":"2026-10-28T19:45:02.435742274Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793208938","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.1-tuxcare.3.","status":"published","published":"2026-10-28T17:35:38Z","modified":"2026-10-28T19:45:02.440351013Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209037","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.13.2.2-tuxcare.2.","status":"published","published":"2026-10-28T17:37:17Z","modified":"2026-10-28T19:45:06.93932122Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209495","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.11.0-tuxcare.2.","status":"published","published":"2026-10-28T17:44:55Z","modified":"2026-10-28T19:45:06.945724365Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209588","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.11.3-tuxcare.3.","status":"published","published":"2026-10-28T17:46:28Z","modified":"2026-10-28T19:45:10.205285237Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209672","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.6.6-tuxcare.2.","status":"published","published":"2026-10-28T17:47:52Z","modified":"2026-11-06T13:28:04.306039112Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793209760","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.8.10-tuxcare.2.","status":"published","published":"2026-10-28T17:49:20Z","modified":"2026-10-28T19:45:10.202642039Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209895","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.13.4-tuxcare.2.","status":"published","published":"2026-10-28T17:51:35Z","modified":"2026-10-28T19:45:10.206260592Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793214775","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.9.10.8-tuxcare.2.","status":"published","published":"2026-10-28T19:12:55Z","modified":"2026-10-29T02:15:02.466049971Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793260179","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.11.4-tuxcare.2.","status":"published","published":"2026-10-29T07:49:39Z","modified":"2026-10-29T13:45:03.33177707Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793260214","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.7.9.7-tuxcare.2.","status":"published","published":"2026-10-29T07:50:14Z","modified":"2026-10-29T13:45:02.578940084Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793260230","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.10.2-tuxcare.2.","status":"published","published":"2026-10-29T07:50:30Z","modified":"2026-10-29T13:45:04.232239626Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793260240","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.9.2-tuxcare.2.","status":"published","published":"2026-10-29T07:50:40Z","modified":"2026-10-29T13:45:04.236476322Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793260371","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.10.3-tuxcare.2.","status":"published","published":"2026-10-29T07:52:51Z","modified":"2026-10-29T13:45:03.333230368Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793273163","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.9.10-tuxcare.2.","status":"published","published":"2026-10-29T11:26:03Z","modified":"2026-10-29T13:45:05.045153495Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793273322","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.9.8-tuxcare.2.","status":"published","published":"2026-10-29T11:28:42Z","modified":"2026-10-29T13:45:05.149763154Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793273384","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.12.6.1-tuxcare.3.","status":"published","published":"2026-10-29T11:29:44Z","modified":"2026-10-29T13:45:02.583652093Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793274003","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.9.1-tuxcare.2.","status":"published","published":"2026-10-29T11:40:03Z","modified":"2026-10-29T13:45:03.341811026Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793274225","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.7-tuxcare.4.","status":"published","published":"2026-10-29T11:43:45Z","modified":"2026-10-29T13:45:04.351945136Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793274468","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.12.6-tuxcare.2.","status":"published","published":"2026-10-29T11:47:48Z","modified":"2026-10-29T13:45:02.564232673Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793274500","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.10.3-tuxcare.3.","status":"published","published":"2026-10-29T11:48:20Z","modified":"2026-10-29T13:45:03.325117247Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793274960","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.7-tuxcare.3.","status":"published","published":"2026-10-29T11:56:00Z","modified":"2026-10-29T13:45:04.39617026Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793287973","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.7.1-tuxcare.3.","status":"published","published":"2026-10-29T16:32:54Z","modified":"2026-10-29T19:45:48.457490155Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793288062","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.4-tuxcare.3.","status":"published","published":"2026-10-29T16:34:23Z","modified":"2026-10-29T19:45:48.052059254Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793288185","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.7.9-tuxcare.2.","status":"published","published":"2026-10-29T16:36:26Z","modified":"2026-10-29T19:45:48.457480331Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793288285","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.5-tuxcare.3.","status":"published","published":"2026-10-29T16:38:06Z","modified":"2026-10-29T19:45:48.101531195Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793288379","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.11.1-tuxcare.2.","status":"published","published":"2026-10-29T16:39:39Z","modified":"2026-10-29T19:45:47.994810563Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793288485","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.7-tuxcare.2.","status":"published","published":"2026-10-29T16:41:26Z","modified":"2026-10-29T19:45:48.455353151Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793288575","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.7.5-tuxcare.2.","status":"published","published":"2026-10-29T16:42:56Z","modified":"2026-11-06T13:28:04.235220221Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793288673","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.3-tuxcare.3.","status":"published","published":"2026-10-29T16:44:34Z","modified":"2026-10-29T19:45:48.555973988Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793294610","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.4.5-tuxcare.2.","status":"published","published":"2026-10-29T18:23:31Z","modified":"2026-11-06T13:28:04.41174282Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793294643","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.11-tuxcare.2.","status":"published","published":"2026-10-29T18:24:04Z","modified":"2026-10-30T02:15:04.449175919Z","updated_at":"2026-11-02T15:43:55.669514Z"}]},"sources_more":{"osv":61}}