{"id":"CVE-2026-91777","aliases":["ALSA-2026:85231","ALSA-2026:90909","CLSA-2026-1791487635","CLSA-2026-1792441992","CLSA-2026-1792479357","CLSA-2026-1793200513","CLSA-2026-1793201235","CLSA-2026-1793208732","CLSA-2026-1793208938","CLSA-2026-1793209037","CLSA-2026-1793209226","CLSA-2026-1793209588","CLSA-2026-1793209895","CLSA-2026-1793260179","CLSA-2026-1793260226","CLSA-2026-1793273163","CLSA-2026-1793273322","CLSA-2026-1793273384","CLSA-2026-1793274003","CLSA-2026-1793274225","CLSA-2026-1793274468","CLSA-2026-1793274500","CLSA-2026-1793274960","CLSA-2026-1793287973","CLSA-2026-1793288062","CLSA-2026-1793288185","CLSA-2026-1793288285","CLSA-2026-1793288379","CLSA-2026-1793288485","CLSA-2026-1793288575","CLSA-2026-1793288673","CLSA-2026-1793294610","CLSA-2026-1793294643","CLSA-2026-1793294975","CLSA-2026-1793295217","CLSA-2026-1793295274","CLSA-2026-1793295302","CLSA-2026-1793295362","CLSA-2026-1793295423","CLSA-2026-1793295575","CLSA-2026-1793349010","CLSA-2026-1793349383","CLSA-2026-1793360676","CLSA-2026-1793360781","CLSA-2026-1793361197","CLSA-2026-1793362140","CLSA-2026-1793362223","CLSA-2026-1793362246","CLSA-2026-1793362272","CLSA-2026-1793362279","CLSA-2026-1793362281","CLSA-2026-1793362367","CLSA-2026-1793363087","CLSA-2026-1793363126","CLSA-2026-1793520224","CLSA-2026-1793520322","CLSA-2026-1793520513","CLSA-2026-1793520709","CLSA-2026-1793521072","CLSA-2026-1793521151","CLSA-2026-1793521240","CLSA-2026-1793521464","CLSA-2026-1793521537","CLSA-2026-1793521766","CLSA-2026-1793522050","CLSA-2026-1793522157","CLSA-2026-1793522232","CLSA-2026-1793522561","CLSA-2026-1793522726","CLSA-2026-1793530438","CLSA-2026-1793530637","CLSA-2026-1793531058","CLSA-2026-1793531544","CLSA-2026-1793531790","CLSA-2026-1793531937","CLSA-2026-1793532071","CLSA-2026-1793532239","CLSA-2026-1793532432","CLSA-2026-1793532508","CLSA-2026-1793532613","CLSA-2026-1793532740","CLSA-2026-1793532868","CLSA-2026-1793533006","CLSA-2026-1793537797","CLSA-2026-1793537928","CLSA-2026-1793538030","CLSA-2026-1793538225","CLSA-2026-1793538355","DEBIAN-CVE-2026-91777","EUVD-2026-85003","GHSA-cxp5-3px4-pw24","RHSA-2026:85231","RLSA-2026:85231","RLSA-2026:90909","RLSA-2026:98492","SUSE-SU-2026:24149-1","SUSE-SU-2026:4394-1","UBUNTU-CVE-2026-91777","openSUSE-SU-2026:11877-1","openSUSE-SU-2026:22034-1"],"aliases_more":13,"status":"published","title":"jackson-databind: quadratic forward-reference completion in Collection and Map deserializers","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00487,"percentile":0.42386,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-09-23T02:21:48Z","modified":"2026-11-12T00:30:03Z","fixes":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.21.7","2.18.11","2.22.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","fixed_in":["3.1.7","3.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:9","package":"pki-jackson-databind","fixed_in":["2.21.6-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.10.5.1-tuxcare.3","2.19.0-tuxcare.3","2.11.0-tuxcare.3","2.16.1-tuxcare.3","2.18.8-tuxcare.3","2.9.10.8-tuxcare.3","2.20.1-tuxcare.4","2.18.2-tuxcare.3","2.15.2-tuxcare.6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jackson-databind","fixed_in":["2.18.11-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"jackson-databind","fixed_in":["0:2.21.6-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pki-jackson-databind","fixed_in":["0:2.21.6-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"jackson-databind","fixed_in":["0:2.21.6-1.el9_8.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"last_affected":"2.21.6"},{"fixed":"2.21.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.1.6"},{"fixed":"3.1.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"last_affected":"3.2.2"},{"fixed":"3.2.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"last_affected":"2.18.10"},{"fixed":"2.18.11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"last_affected":"2.22.2"},{"fixed":"2.22.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pki-jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.6-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-10.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-21.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apache-commons-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-3.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bea-stax-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-16.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-fastinfoset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-9.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-jaxb-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-jaxb-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-12.module_el8.10.0+3791+e0637953"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-jaxb-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-12.module_el8.10.0+3791+e0637953"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"glassfish-jaxb-txw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-12.module_el8.10.0+3791+e0637953"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-1.module_el8.10.0+4235+0924958e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4329+908ad137.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4329+908ad137.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-jaxrs-json-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4235+0924958e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-jaxrs-providers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-1.module_el8.10.0+4235+0924958e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jackson-module-jaxb-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.4-2.module_el8.10.0+4235+0924958e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"javassist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"javassist-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pki-servlet-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-1.module_el8.10.0+3791+e0637953"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"relaxngDatatype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2011.1-7.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.25-4.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slf4j-jdk14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.25-4.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"stax-ex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7-24.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-38.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-34.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.01-25.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xml-commons-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-26.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xmlstreambuffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-8.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"xsom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-19.20110809svn.module_el8.5.0+2577+9e95fe00"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.3"},{"fixed":"2.17.3-tuxcare.3"}]}],"versions":["2.17.3","2.17.3-tuxcare.1","2.17.3-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.2"},{"fixed":"2.17.2-tuxcare.2"}]}],"versions":["2.17.2","2.17.2-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.2"},{"fixed":"2.14.2-tuxcare.3"}]}],"versions":["2.14.2","2.14.2-tuxcare.1","2.14.2-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.8"},{"fixed":"2.7.8-tuxcare.2"}]}],"versions":["2.7.8","2.7.8-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.2"},{"fixed":"2.21.2-tuxcare.1"}]}],"versions":["2.21.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.1"},{"fixed":"2.13.1-tuxcare.2"}]}],"versions":["2.13.1","2.13.1-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.3"}]}],"versions":["2.12.1","2.12.1-tuxcare.1","2.12.1-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.2.2"},{"fixed":"2.13.2.2-tuxcare.2"}]}],"versions":["2.13.2.2","2.13.2.2-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.1.1"},{"fixed":"2.4.1.1-tuxcare.2"}]}],"versions":["2.4.1.1","2.4.1.1-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.3"},{"fixed":"2.11.3-tuxcare.3"}]}],"versions":["2.11.3","2.11.3-tuxcare.1","2.11.3-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.4"},{"fixed":"2.13.4-tuxcare.2"}]}],"versions":["2.13.4","2.13.4-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.4"},{"fixed":"2.11.4-tuxcare.2"}]}],"versions":["2.11.4","2.11.4-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.0-tuxcare.2"}]}],"versions":["2.4.0","2.4.0-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10"},{"fixed":"2.9.10-tuxcare.2"}]}],"versions":["2.9.10","2.9.10-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.8"},{"fixed":"2.9.8-tuxcare.2"}]}],"versions":["2.9.8","2.9.8-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.6.1"},{"fixed":"2.12.6.1-tuxcare.3"}]}],"versions":["2.12.6.1","2.12.6.1-tuxcare.1","2.12.6.1-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9.1"},{"fixed":"2.9.9.1-tuxcare.2"}]}],"versions":["2.9.9.1","2.9.9.1-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.7"},{"fixed":"2.8.7-tuxcare.4"}]}],"versions":["2.8.7","2.8.7-tuxcare.1","2.8.7-tuxcare.2","2.8.7-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.6"},{"fixed":"2.12.6-tuxcare.2"}]}],"versions":["2.12.6","2.12.6-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.3"},{"fixed":"2.9.10.3-tuxcare.3"}]}],"versions":["2.9.10.3","2.9.10.3-tuxcare.1","2.9.10.3-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.7"},{"fixed":"2.12.7-tuxcare.3"}]}],"versions":["2.12.7","2.12.7-tuxcare.1","2.12.7-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1"},{"fixed":"2.7.1-tuxcare.3"}]}],"versions":["2.7.1","2.7.1-tuxcare.1","2.7.1-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.4"},{"fixed":"2.8.4-tuxcare.3"}]}],"versions":["2.8.4","2.8.4-tuxcare.1","2.8.4-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.2"}]}],"versions":["2.7.9","2.7.9-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.5"},{"fixed":"2.8.5-tuxcare.3"}]}],"versions":["2.8.5","2.8.5-tuxcare.1","2.8.5-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.1"},{"fixed":"2.8.11.1-tuxcare.2"}]}],"versions":["2.8.11.1","2.8.11.1-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.7"},{"fixed":"2.9.7-tuxcare.2"}]}],"versions":["2.9.7","2.9.7-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.5"},{"fixed":"2.7.5-tuxcare.2"}]}],"versions":["2.7.5","2.7.5-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.3"},{"fixed":"2.9.3-tuxcare.3"}]}],"versions":["2.9.3","2.9.3-tuxcare.1","2.9.3-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5"},{"fixed":"2.4.5-tuxcare.2"}]}],"versions":["2.4.5","2.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11"},{"fixed":"2.8.11-tuxcare.2"}]}],"versions":["2.8.11","2.8.11-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.10"},{"fixed":"2.8.10-tuxcare.3"}]}],"versions":["2.8.10","2.8.10-tuxcare.1","2.8.10-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.1"},{"fixed":"2.4.1-tuxcare.2"}]}],"versions":["2.4.1","2.4.1-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7.3"},{"fixed":"2.6.7.3-tuxcare.3"}]}],"versions":["2.6.7.3","2.6.7.3-tuxcare.1","2.6.7.3-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.3"},{"fixed":"2.4.3-tuxcare.2"}]}],"versions":["2.4.3","2.4.3-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7.2"},{"fixed":"2.6.7.2-tuxcare.3"}]}],"versions":["2.6.7.2","2.6.7.2-tuxcare.1","2.6.7.2-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.4"},{"fixed":"2.9.4-tuxcare.2"}]}],"versions":["2.9.4","2.9.4-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.13.0-tuxcare.3"}]}],"versions":["2.13.0","2.13.0-tuxcare.1","2.13.0-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2"},{"fixed":"3.1.2-tuxcare.1"}]}],"versions":["3.1.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.4"},{"fixed":"2.12.4-tuxcare.3"}]}],"versions":["2.12.4","2.12.4-tuxcare.1","2.12.4-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.4"},{"fixed":"2.5.4-tuxcare.3"}]}],"versions":["2.5.4","2.5.4-tuxcare.1","2.5.4-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.6"},{"fixed":"2.6.6-tuxcare.3"}]}],"versions":["2.6.6","2.6.6-tuxcare.1","2.6.6-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.4"},{"fixed":"2.10.4-tuxcare.3"}]}],"versions":["2.10.4","2.10.4-tuxcare.1","2.10.4-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.7"},{"fixed":"2.9.10.7-tuxcare.3"}]}],"versions":["2.9.10.7","2.9.10.7-tuxcare.1","2.9.10.7-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.4"},{"fixed":"2.18.4-tuxcare.3"}]}],"versions":["2.18.4","2.18.4-tuxcare.1","2.18.4-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.2"},{"fixed":"2.16.2-tuxcare.3"}]}],"versions":["2.16.2","2.16.2-tuxcare.1","2.16.2-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.1"},{"fixed":"2.15.1-tuxcare.3"}]}],"versions":["2.15.1","2.15.1-tuxcare.1","2.15.1-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.2"},{"fixed":"2.10.2-tuxcare.3"}]}],"versions":["2.10.2","2.10.2-tuxcare.1","2.10.2-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3"},{"fixed":"2.10.3-tuxcare.3"}]}],"versions":["2.10.3","2.10.3-tuxcare.1","2.10.3-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.0"},{"fixed":"2.15.0-tuxcare.2"}]}],"versions":["2.15.0","2.15.0-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.4"},{"fixed":"2.15.4-tuxcare.4"}]}],"versions":["2.15.4","2.15.4-tuxcare.1","2.15.4-tuxcare.2","2.15.4-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.5"},{"fixed":"2.18.5-tuxcare.3"}]}],"versions":["2.18.5","2.18.5-tuxcare.1","2.18.5-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9.7"},{"fixed":"2.7.9.7-tuxcare.3"}]}],"versions":["2.7.9.7","2.7.9.7-tuxcare.1","2.7.9.7-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.4"},{"fixed":"2.9.10.4-tuxcare.3"}]}],"versions":["2.9.10.4","2.9.10.4-tuxcare.1","2.9.10.4-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.3"},{"fixed":"2.8.11.3-tuxcare.2"}]}],"versions":["2.8.11.3","2.8.11.3-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1-tuxcare.2"}]}],"versions":["2.9.1","2.9.1-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9.3"},{"fixed":"2.7.9.3-tuxcare.3"}]}],"versions":["2.7.9.3","2.7.9.3-tuxcare.1","2.7.9.3-tuxcare.2"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9"},{"fixed":"2.9.9-tuxcare.2"}]}],"versions":["2.9.9","2.9.9-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9.3"},{"fixed":"2.9.9.3-tuxcare.2"}]}],"versions":["2.9.9.3","2.9.9.3-tuxcare.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.4"},{"fixed":"2.8.11.4-tuxcare.2"}]}],"versions":["2.8.11.4","2.8.11.4-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.5"},{"fixed":"2.9.5-tuxcare.2"}]}],"versions":["2.9.5","2.9.5-tuxcare.1"],"bundled":19},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.4"},{"fixed":"2.6.4-tuxcare.2"}]}],"versions":["2.6.4","2.6.4-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.3"},{"fixed":"2.7.3-tuxcare.3"}]}],"versions":["2.7.3","2.7.3-tuxcare.1","2.7.3-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.18.0-tuxcare.3"}]}],"versions":["2.18.0","2.18.0-tuxcare.1","2.18.0-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.1"},{"fixed":"2.9.10.1-tuxcare.2"}]}],"versions":["2.9.10.1","2.9.10.1-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.2"},{"fixed":"2.9.2-tuxcare.3"}]}],"versions":["2.9.2","2.9.2-tuxcare.1","2.9.2-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.2"},{"fixed":"2.12.2-tuxcare.3"}]}],"versions":["2.12.2","2.12.2-tuxcare.1","2.12.2-tuxcare.2"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7.1"},{"fixed":"2.6.7.1-tuxcare.3"}]}],"versions":["2.6.7.1","2.6.7.1-tuxcare.1","2.6.7.1-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.5"},{"fixed":"2.6.5-tuxcare.3"}]}],"versions":["2.6.5","2.6.5-tuxcare.1","2.6.5-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.0"},{"fixed":"2.16.0-tuxcare.4"}]}],"versions":["2.16.0","2.16.0-tuxcare.1","2.16.0-tuxcare.2","2.16.0-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.3"},{"fixed":"2.6.3-tuxcare.3"}]}],"versions":["2.6.3","2.6.3-tuxcare.1","2.6.3-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0"},{"fixed":"2.17.0-tuxcare.2"}]}],"versions":["2.17.0","2.17.0-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.4"},{"fixed":"2.21.4-tuxcare.2"}]}],"versions":["2.21.4","2.21.4-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.4.2"},{"fixed":"2.13.4.2-tuxcare.3"}]}],"versions":["2.13.4.2","2.13.4.2-tuxcare.1","2.13.4.2-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.4"},{"fixed":"2.19.4-tuxcare.2"}]}],"versions":["2.19.4","2.19.4-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.5"},{"fixed":"2.12.5-tuxcare.3"}]}],"versions":["2.12.5","2.12.5-tuxcare.1","2.12.5-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.5"},{"fixed":"2.13.5-tuxcare.3"}]}],"versions":["2.13.5","2.13.5-tuxcare.1","2.13.5-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.1"},{"fixed":"2.17.1-tuxcare.4"}]}],"versions":["2.17.1","2.17.1-tuxcare.1","2.17.1-tuxcare.2","2.17.1-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.1"},{"fixed":"2.11.1-tuxcare.4"}]}],"versions":["2.11.1","2.11.1-tuxcare.1","2.11.1-tuxcare.2","2.11.1-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.2"},{"fixed":"2.19.2-tuxcare.2"}]}],"versions":["2.19.2","2.19.2-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.1"},{"fixed":"2.14.1-tuxcare.3"}]}],"versions":["2.14.1","2.14.1-tuxcare.1","2.14.1-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.5.1"},{"fixed":"2.10.5.1-tuxcare.3"}]}],"versions":["2.10.5.1","2.10.5.1-tuxcare.1","2.10.5.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.19.0-tuxcare.3"}]}],"versions":["2.19.0","2.19.0-tuxcare.1","2.19.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.3"},{"fixed":"2.18.3-tuxcare.4"}]}],"versions":["2.18.3","2.18.3-tuxcare.1","2.18.3-tuxcare.2","2.18.3-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.0-tuxcare.3"}]}],"versions":["2.11.0","2.11.0-tuxcare.1","2.11.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.1"},{"fixed":"2.16.1-tuxcare.3"}]}],"versions":["2.16.1","2.16.1-tuxcare.1","2.16.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.8"},{"fixed":"2.18.8-tuxcare.3"}]}],"versions":["2.18.8","2.18.8-tuxcare.1","2.18.8-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.8"},{"fixed":"2.9.10.8-tuxcare.3"}]}],"versions":["2.9.10.8","2.9.10.8-tuxcare.1","2.9.10.8-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.1"},{"fixed":"2.20.1-tuxcare.4"}]}],"versions":["2.20.1","2.20.1-tuxcare.1","2.20.1-tuxcare.2","2.20.1-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.6"},{"fixed":"2.9.10.6-tuxcare.2"}]}],"versions":["2.9.10.6","2.9.10.6-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.0-tuxcare.3"}]}],"versions":["2.7.0","2.7.0-tuxcare.1","2.7.0-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.7.1"},{"fixed":"2.12.7.1-tuxcare.4"}]}],"versions":["2.12.7.1","2.12.7.1-tuxcare.1","2.12.7.1-tuxcare.2","2.12.7.1-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.3"},{"fixed":"2.13.3-tuxcare.2"}]}],"versions":["2.13.3","2.13.3-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.2"},{"fixed":"2.11.2-tuxcare.2"}]}],"versions":["2.11.2","2.11.2-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.2"},{"fixed":"2.18.2-tuxcare.3"}]}],"versions":["2.18.2","2.18.2-tuxcare.1","2.18.2-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.5"},{"fixed":"2.9.10.5-tuxcare.2"}]}],"versions":["2.9.10.5","2.9.10.5-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.3"},{"fixed":"2.14.3-tuxcare.2"}]}],"versions":["2.14.3","2.14.3-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.3"},{"fixed":"2.15.3-tuxcare.5"}]}],"versions":["2.15.3","2.15.3-tuxcare.1","2.15.3-tuxcare.2","2.15.3-tuxcare.3","2.15.3-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.2"},{"fixed":"2.15.2-tuxcare.6"}]}],"versions":["2.15.2","2.15.2-tuxcare.1","2.15.2-tuxcare.2","2.15.2-tuxcare.3","2.15.2-tuxcare.4","2.15.2-tuxcare.5"]},{"source":"osv","ecosystem":"Debian:12","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-2","2.14.0+ds-3","2.14.0-1","2.14.0-1+deb12u1","2.18.11-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-1+deb13u1","2.14.0+ds-2","2.14.0+ds-3","2.18.11-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-1"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-2","2.14.0+ds-3"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.21.7"}]}],"versions":["2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.0-rc1","2.20.1","2.20.2","2.21.0","2.21.1","2.21.2","2.21.3","2.21.4","2.21.5","2.21.6"]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.7"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6"]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.3"}]}],"versions":["3.2.0","3.2.1","3.2.2"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.18.11"}]}],"versions":["2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.5.1","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1","2.13.2.2","2.13.3","2.13.4","2.13.4.1","2.13.4.2","2.13.5","2.14.0","2.14.0-rc1","2.14.0-rc2","2.14.0-rc3","2.14.1","2.14.2","2.14.3","2.15.0","2.15.0-rc1","2.15.0-rc2","2.15.0-rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0-rc1","2.16.1","2.16.2","2.17.0","2.17.0-rc1","2.17.1","2.17.2","2.17.3","2.18.0","2.18.0-rc1","2.18.1","2.18.10","2.18.2","2.18.3","2.18.4","2.18.5","2.18.6","2.18.7","2.18.8","2.18.9","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.0","2.6.0-rc1","2.6.0-rc2","2.6.0-rc3","2.6.0-rc4","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.7.1","2.6.7.2","2.6.7.3","2.6.7.4","2.6.7.5","2.7.0","2.7.0-rc1","2.7.0-rc2","2.7.0-rc3","2.7.1","2.7.1-1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.7.9.1","2.7.9.2","2.7.9.3","2.7.9.4","2.7.9.5","2.7.9.6","2.7.9.7","2.8.0","2.8.0.rc1","2.8.0.rc2","2.8.1","2.8.10","2.8.11","2.8.11.1","2.8.11.2","2.8.11.3","2.8.11.4","2.8.11.5","2.8.11.6","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.8.1","2.8.9","2.9.0","2.9.0.pr1","2.9.0.pr2","2.9.0.pr3","2.9.0.pr4","2.9.1","2.9.10","2.9.10.1","2.9.10.2","2.9.10.3","2.9.10.4","2.9.10.5","2.9.10.6","2.9.10.7","2.9.10.8","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2.9.9.1","2.9.9.2","2.9.9.3"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"fixed":"2.22.3"}]}],"versions":["2.22.0","2.22.1","2.22.2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.6-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pki-jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.6-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.6-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-10.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-10.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-10.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6-21.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6-21.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-3.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-3.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apache-commons-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-3.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-16.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bea-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-16.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-fastinfoset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-9.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-fastinfoset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-9.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-jaxb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.11-12.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-jaxb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.11-12.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-jaxb-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.12-8.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"glassfish-jaxb-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.12-8.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21-1.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40398+3ebe5a98.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-jaxrs-providers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-1.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jackson-modules-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.4-2.module+el8.10.0+40260+021059e6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1-28.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"javassist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.1-8.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"javassist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.1-8.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"javassist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.1-8.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pki-servlet-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-1.module+el8.10.0+1767+f923f786"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pki-servlet-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-1.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"relaxngDatatype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2011.1-7.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"relaxngDatatype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2011.1-7.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.6.0+843+5a13dac3"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.25-4.module+el8.10.0+2003+8aeac9cb"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"stax-ex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.7-8.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"stax-ex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.7-8.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7-24.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7-24.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7-24.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-38.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-38.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-38.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-34.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-34.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11.0-34.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.01-25.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.01-25.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.01-25.module+el8.10.0+2003+8aeac9cb"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.01-25.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2-26.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2-26.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xml-commons-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2-26.module+el8.3.0+74+855e3f5d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xmlstreambuffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-8.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xmlstreambuffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-8.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xsom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0-19.20110809svn.module+el8.10.0+1763+c7c02164"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"xsom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0-19.20110809svn.module+el8.10.0+2052+1b0fb438"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.6-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-1","2.2.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-2","2.4.2-3","2.4.2-3ubuntu0.1~esm1","2.4.2-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.6-1","2.9.1-1","2.9.4-1","2.9.5-1","2.9.8-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.9.3-1","2.10.0-2","2.10.1-1","2.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-1","2.12.5-1","2.13.0-1","2.13.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1build1","2.14.0+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10}],"products":[{"vendor":"fasterxml","product":"jackson-databind"}],"references":[{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","tags":["vendor-advisory","exploit","advisory","web","article","report"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/6204","tags":["patch","fix","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/6204","tags":["web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24"},{"url":"https://access.redhat.com/errata/RHSA-2026:85231","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-91777","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539085","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-85231.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90909","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-68498","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89425","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539084","tags":["report"]},{"url":"https://bugzilla.redhat.com/2554486","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-90909.html","tags":["advisory"]},{"url":"https://repo1.maven.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-91777","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539085","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85231.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91777","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85231","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90909","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554486","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98492","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98492","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624149-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273856","tags":["report"]},{"url":"https://bugzilla.suse.com/1273857","tags":["report"]},{"url":"https://bugzilla.suse.com/1277883","tags":["report"]},{"url":"https://bugzilla.suse.com/1278008","tags":["report"]},{"url":"https://bugzilla.suse.com/1280125","tags":["report"]},{"url":"https://bugzilla.suse.com/1282491","tags":["report"]},{"url":"https://bugzilla.suse.com/1282492","tags":["report"]},{"url":"https://bugzilla.suse.com/1282505","tags":["report"]},{"url":"https://bugzilla.suse.com/1282641","tags":["report"]},{"url":"https://bugzilla.suse.com/1282645","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-83557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91777","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264394-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282639","tags":["report"]},{"url":"https://bugzilla.suse.com/1282640","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68496","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-91777","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-91777","title":"jackson-databind: quadratic forward-reference completion in Collection and Map deserializers","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.","status":"published","published":"2026-09-23T02:21:48.323Z","modified":"2026-09-23T14:05:17.919Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:19:52.773089Z"}],"euvd":[{"id":"EUVD-2026-85003","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.","status":"published","published":"2026-09-23T02:21:48Z","modified":"2026-09-23T14:05:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:00.949397Z"}],"ghsa":[{"id":"GHSA-cxp5-3px4-pw24","title":"jackson-databind quadratic forward-reference completion ","description":"### Summary\n\nWhen an `@JsonIdentityInfo` collection or map first creates N unresolved\nobject-ID references and later resolves the same IDs in reverse order,\njackson-databind scans the remaining pending-reference accumulator for each\nresolution. A shallow JSON document whose size grows linearly can therefore\ncause quadratic CPU work during deserialization.\n\n### Details\n\nThe affected path is forward-reference completion in\n`CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()`\nand the corresponding map implementation. The implementation performs a\nlinear search of the pending accumulator for every resolved object ID.\n\nThe behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and\n3.2.1. Current 2.22 and 3.2 source branches retained the same design when\nrechecked. A 2.4.0 control fails closed before successful reverse-order\ncompletion, so 2.5.0 is the conservative runtime-confirmed affected floor.\nThe patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must deserialize attacker-influenced JSON into an\nidentity-enabled collection or map. The issue does not require deep nesting or\nsyntactically unusual JSON.\n\nSuggested correction: replace repeated linear lookup/removal with a keyed\npending-reference structure or another design that provides linear or\namortized-linear completion. A regression should preserve input order,\nduplicate-ID behavior, and unresolved-ID errors while bounding reverse-order\nresolution work.\n\n### PoC\n\nThe proof constructs a shallow collection containing N unresolved\n`@JsonIdentityInfo` references followed by definitions of those same IDs in\nreverse order. Its ID class counts `equals()` calls, giving a deterministic\nwork measure rather than a timing-dependent result.\n\nWith N=2,000, affected versions perform exactly 2,003,000 ID comparisons. An\nequally sized control in which every reference is already resolved performs\nzero comparisons in the pending-reference lookup path. The run is bounded to\na 512 MiB JVM. The result demonstrates quadratic growth: approximately\n`N * (N + 1) / 2` comparisons, plus fixed setup comparisons.\n\n### Impact\n\nAn unauthenticated source that can submit JSON to an application using the\naffected identity-enabled collection or map shape can consume quadratic CPU\nand exhaust a request-time or worker-capacity budget, causing denial of\nservice. The application model/configuration prerequisite is material. No\nconfidentiality, integrity, code-execution, or parser-depth impact is claimed.\n\nRequested credit: Daniel Birtwhistle","status":"published","published":"2026-09-30T15:37:24Z","modified":"2026-09-30T15:37:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.","status":"published","published":"2026-09-23T03:17:04.783Z","modified":"2026-09-24T20:43:32.537Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-91777","title":"jackson-databind: quadratic forward-reference completion in Collection and Map deserializers","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.","status":"published","published":"2026-09-23T02:21:48.323Z","modified":"2026-10-29T11:12:04.884812491Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:20.269367Z"},{"id":"DEBIAN-CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.","status":"published","published":"2026-09-23T03:17:04.783Z","modified":"2026-10-20T04:00:07.451412099Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:06.410207Z"},{"id":"GHSA-cxp5-3px4-pw24","title":"jackson-databind quadratic forward-reference completion ","description":"### Summary\n\nWhen an `@JsonIdentityInfo` collection or map first creates N unresolved\nobject-ID references and later resolves the same IDs in reverse order,\njackson-databind scans the remaining pending-reference accumulator for each\nresolution. A shallow JSON document whose size grows linearly can therefore\ncause quadratic CPU work during deserialization.\n\n### Details\n\nThe affected path is forward-reference completion in\n`CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()`\nand the corresponding map implementation. The implementation performs a\nlinear search of the pending accumulator for every resolved object ID.\n\nThe behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and\n3.2.1. Current 2.22 and 3.2 source branches retained the same design when\nrechecked. A 2.4.0 control fails closed before successful reverse-order\ncompletion, so 2.5.0 is the conservative runtime-confirmed affected floor.\nThe patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must deserialize attacker-influenced JSON into an\nidentity-enabled collection or map. The issue does not require deep nesting or\nsyntactically unusual JSON.\n\nSuggested correction: replace repeated linear lookup/removal with a keyed\npending-reference structure or another design that provides linear or\namortized-linear completion. A regression should preserve input order,\nduplicate-ID behavior, and unresolved-ID errors while bounding reverse-order\nresolution work.\n\n### PoC\n\nThe proof constructs a shallow collection containing N unresolved\n`@JsonIdentityInfo` references followed by definitions of those same IDs in\nreverse order. Its ID class counts `equals()` calls, giving a deterministic\nwork measure rather than a timing-dependent result.\n\nWith N=2,000, affected versions perform exactly 2,003,000 ID comparisons. An\nequally sized control in which every reference is already resolved performs\nzero comparisons in the pending-reference lookup path. The run is bounded to\na 512 MiB JVM. The result demonstrates quadratic growth: approximately\n`N * (N + 1) / 2` comparisons, plus fixed setup comparisons.\n\n### Impact\n\nAn unauthenticated source that can submit JSON to an application using the\naffected identity-enabled collection or map shape can consume quadratic CPU\nand exhaust a request-time or worker-capacity budget, causing denial of\nservice. The application model/configuration prerequisite is material. No\nconfidentiality, integrity, code-execution, or parser-depth impact is claimed.\n\nRequested credit: Daniel Birtwhistle","status":"published","published":"2026-09-30T15:37:24Z","modified":"2026-09-30T15:46:18.051343022Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"RHSA-2026:85231","title":"Red Hat Security Advisory: jackson-databind security update","status":"published","published":"2026-10-20T10:18:00Z","modified":"2026-10-20T10:31:43.073326025Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:85231","title":"Important: jackson-databind security update","description":"The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.\n\nSecurity Fix(es):\n\n* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-20T12:05:07.452289Z","modified":"2026-10-20T12:15:38.497434649Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:90909","title":"Important: pki-deps:10.6 security update","description":"The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.\n\nSecurity Fix(es):\n\n* com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)\n\n* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)\n\n* com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:01:16.697685Z","modified":"2026-10-29T12:30:03.191240243Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:98492","title":"Important: jackson-databind security update","description":"The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.\n\nSecurity Fix(es):\n\n* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-12T00:04:12.119552Z","modified":"2026-11-12T00:30:03.613921464Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-12T00:54:50.801358Z"},{"id":"UBUNTU-CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.","status":"published","published":"2026-09-23T03:17:00Z","modified":"2026-10-17T13:01:17.166776384Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:40.980117Z"},{"id":"ALSA-2026:85231","title":"Important: jackson-databind security update","description":"The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.  \n\nSecurity Fix(es):  \n\n  * com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:32:38.225781985Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:90909","title":"Important: pki-deps:10.6 security update","description":"The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.  \n\nSecurity Fix(es):  \n\n  * com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)\n  * com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)\n  * com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-29T11:02:25.387689752Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"CLSA-2026-1791487635","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.3-tuxcare.3.","status":"published","published":"2026-10-08T19:27:15Z","modified":"2026-10-15T09:47:44.885262122Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792441992","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.17.2-tuxcare.2.","status":"published","published":"2026-10-19T20:33:12Z","modified":"2026-10-20T01:45:03.627603897Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479357","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.2-tuxcare.3.","status":"published","published":"2026-10-20T06:55:57Z","modified":"2026-10-22T14:30:58.973677104Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793200513","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.7.8-tuxcare.2.","status":"published","published":"2026-10-28T15:15:13Z","modified":"2026-10-28T19:45:03.541160372Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793201235","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.21.2-tuxcare.1.","status":"published","published":"2026-10-28T15:27:15Z","modified":"2026-10-28T19:45:02.437154468Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793208732","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.13.1-tuxcare.2.","status":"published","published":"2026-10-28T17:32:12Z","modified":"2026-10-28T19:45:02.435742274Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793208938","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.12.1-tuxcare.3.","status":"published","published":"2026-10-28T17:35:38Z","modified":"2026-10-28T19:45:02.440351013Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209037","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.13.2.2-tuxcare.2.","status":"published","published":"2026-10-28T17:37:17Z","modified":"2026-10-28T19:45:06.93932122Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209226","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.4.1.1-tuxcare.2.","status":"published","published":"2026-10-28T17:40:26Z","modified":"2026-11-06T13:28:03.948660045Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793209588","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.11.3-tuxcare.3.","status":"published","published":"2026-10-28T17:46:28Z","modified":"2026-10-28T19:45:10.205285237Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209895","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.13.4-tuxcare.2.","status":"published","published":"2026-10-28T17:51:35Z","modified":"2026-10-28T19:45:10.206260592Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793260179","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.11.4-tuxcare.2.","status":"published","published":"2026-10-29T07:49:39Z","modified":"2026-10-29T13:45:03.33177707Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793260226","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.4.0-tuxcare.2.","status":"published","published":"2026-10-29T07:50:26Z","modified":"2026-11-06T13:28:04.62081197Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793273163","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.9.10-tuxcare.2.","status":"published","published":"2026-10-29T11:26:03Z","modified":"2026-10-29T13:45:05.045153495Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793273322","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.9.8-tuxcare.2.","status":"published","published":"2026-10-29T11:28:42Z","modified":"2026-10-29T13:45:05.149763154Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793273384","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.12.6.1-tuxcare.3.","status":"published","published":"2026-10-29T11:29:44Z","modified":"2026-10-29T13:45:02.583652093Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793274003","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.9.1-tuxcare.2.","status":"published","published":"2026-10-29T11:40:03Z","modified":"2026-10-29T13:45:03.341811026Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793274225","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.7-tuxcare.4.","status":"published","published":"2026-10-29T11:43:45Z","modified":"2026-10-29T13:45:04.351945136Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793274468","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.12.6-tuxcare.2.","status":"published","published":"2026-10-29T11:47:48Z","modified":"2026-10-29T13:45:02.564232673Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793274500","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.10.3-tuxcare.3.","status":"published","published":"2026-10-29T11:48:20Z","modified":"2026-10-29T13:45:03.325117247Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793274960","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.7-tuxcare.3.","status":"published","published":"2026-10-29T11:56:00Z","modified":"2026-10-29T13:45:04.39617026Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793287973","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.7.1-tuxcare.3.","status":"published","published":"2026-10-29T16:32:54Z","modified":"2026-10-29T19:45:48.457490155Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793288062","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.4-tuxcare.3.","status":"published","published":"2026-10-29T16:34:23Z","modified":"2026-10-29T19:45:48.052059254Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793288185","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.7.9-tuxcare.2.","status":"published","published":"2026-10-29T16:36:26Z","modified":"2026-10-29T19:45:48.457480331Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793288285","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.5-tuxcare.3.","status":"published","published":"2026-10-29T16:38:06Z","modified":"2026-10-29T19:45:48.101531195Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793288379","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.11.1-tuxcare.2.","status":"published","published":"2026-10-29T16:39:39Z","modified":"2026-10-29T19:45:47.994810563Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793288485","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.7-tuxcare.2.","status":"published","published":"2026-10-29T16:41:26Z","modified":"2026-10-29T19:45:48.455353151Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793288575","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.7.5-tuxcare.2.","status":"published","published":"2026-10-29T16:42:56Z","modified":"2026-11-06T13:28:04.235220221Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793288673","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.3-tuxcare.3.","status":"published","published":"2026-10-29T16:44:34Z","modified":"2026-10-29T19:45:48.555973988Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793294610","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.4.5-tuxcare.2.","status":"published","published":"2026-10-29T18:23:31Z","modified":"2026-11-06T13:28:04.41174282Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793294643","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.11-tuxcare.2.","status":"published","published":"2026-10-29T18:24:04Z","modified":"2026-10-30T02:15:04.449175919Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793294975","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.10-tuxcare.3.","status":"published","published":"2026-10-29T18:29:36Z","modified":"2026-10-30T02:15:05.234844099Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793295217","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.4.1-tuxcare.2.","status":"published","published":"2026-10-29T18:33:38Z","modified":"2026-11-06T13:28:06.472196449Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793295274","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.6.7.3-tuxcare.3.","status":"published","published":"2026-10-29T18:34:35Z","modified":"2026-10-30T02:15:04.448812065Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793295302","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (11 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 11 CVEs. Fixed in 2.4.3-tuxcare.2.","status":"published","published":"2026-10-29T18:35:02Z","modified":"2026-11-06T13:28:02.887970262Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793295362","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.6.7.2-tuxcare.3.","status":"published","published":"2026-10-29T18:36:03Z","modified":"2026-11-06T13:28:05.75703989Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793295423","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.4-tuxcare.2.","status":"published","published":"2026-10-29T18:37:04Z","modified":"2026-10-30T02:15:05.290238902Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793295575","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.13.0-tuxcare.3.","status":"published","published":"2026-10-29T18:39:37Z","modified":"2026-10-30T02:15:04.44483641Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793349010","title":"TuxCare security update for tools.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt tools.jackson.core:jackson-databind to address 6 CVEs. Fixed in 3.1.2-tuxcare.1.","status":"published","published":"2026-10-30T09:30:11Z","modified":"2026-10-30T13:30:10.126904089Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793349383","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.4-tuxcare.3.","status":"published","published":"2026-10-30T09:36:23Z","modified":"2026-10-30T13:30:10.689213278Z","updated_at":"2026-11-02T15:43:55.669514Z"}]},"sources_more":{"osv":63}}