Important: Red Hat Security Advisory: jackson-databind security update

An update for jackson-databind is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing

A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service DoS by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar fields from JSON strings,...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion

A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing o...

Important: Red Hat Security Advisory: jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 9 : jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base (RHSA-2026:89734)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89734 advisory. Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fixes:...

RHEL 9 : jackson-databind (RHSA-2026:89924)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89924 advisory. The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator...

Security Bulletin: IBM Db2 Bridge is vulnerable due to Authlib, urllib3, jackson-databind, source-map-js, Axios, and python-jose

Summary Authlib, urllib3, jackson-databind, source-map-js, Axios, and python-jose is used as part of IBM Db2 Bridge and it was affected by vulnerabilities described in the vulnerability details. This issue Affected users using Db2 Bridge 1.1.5.2 and new Fix pack was release to address the issue...

Amazon Linux 2023 : jackson-databind (ALAS2023-2026-3305)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3305 advisory. jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-84057 DESCRIPTION: IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elemen...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and...

CLEANSTART-2026-YK30931 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Security vulnerability affects the wildfly package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...

Important: jackson-databind

Issue Overview: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throw...

Security Bulletin: IBM Test Accelerator for Z uses jackson-databind-2.22.2.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777

Summary IBM Test Accelerator for Z uses jackson-databind-2.22.2.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777. This security bulletin provides details about the vulnerability and the corresponding remediation. Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION:...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by a Jackson-databind access control bypass vulnerability

Summary SPSS Collaboration and Deployment Services is affected by a Jackson-databind access control bypass vulnerability. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-59889 DESCRIPTION: jackson-databind contains the general-purpose data-binding...

Security Bulletin: IBM SPSS Modeler is affected by a Jackson-databind vulnerability that could bypass @JsonView access restrictions under certain deserialization scenarios

Summary IBM SPSS Modeler is affected by a Jackson-databind vulnerability that could bypass @JsonView access restrictions under certain deserialization scenarios. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-59889 DESCRIPTION: jackson-databind contains t...

CLSA-2026-1792748024 TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.14.2-tuxcare.4...

Security Bulletin:Multiple vulnerabilities in jackson-databind may affect IBM Infosphere Change Data Capture (CVE-2026-91776, CVE-2026-91777)

Summary Multiple security vulnerabilities have been identified in jackson-databind, General data-binding functionality for Jackson. jackson-databind is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediati...

Security Bulletin:Multiple vulnerabilities in jackson-databind may affect IBM Infosphere Change Data Capture (CVE-2026-19032, CVE-2026-83557)

Summary Multiple security vulnerabilities have been identified in jackson-databind, General data-binding functionality for Jackson. jackson-databind is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediati...

CLEANSTART-2026-EA40241 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...

CLEANSTART-2026-GI33079 jackson-databind's deserializer for java

CVE-2026-19032 affects multiple packages. jackson-databind's deserializer for java. See references for individual vulnerability details...