CLEANSTART-2026-ST77760 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

Security Bulletin: Multiple Security Vulnerabilities in Jackson affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumption issues in FasterXML jackson-databind

Summary IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumption issues in FasterXML jackson-databind. FasterXML jackson-databind is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in jackson-databind (CVE-2026-68497)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in jackson-databind due to deserializer flaws. Jackson-databind is used in our Speech microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerabili...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Unsafe Reflection and Deserialization of Untrusted Data in jackson-databind (CVE-2026-19032, CVE-2026-83557)

Summary IBM Watson Speech Services Cartridge is vulnerable to Unsafe Reflection and Deserialization of Untrusted Data in jackson-databind, due to issues with the DefaultBaseTypeLimitingValidator and deserializer for java.nio.file. Jackson-databind is used in our Speech microservices. These...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improperly Controlled Modification of Object Attributes in jackson-databind (CVE-2026-54515)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improperly Controlled Modification of Object Attributes in jackson-databind. This is due to a flaw in the per-property case-insensitivity block, that overwrites the filtered map — restoring already removed properties and making...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Incorrect Authorization in jackson-databind (CVE-2026-59889)

Summary IBM Watson Speech Services Cartridge is vulnerable to Incorrect Authorization in jackson-databind due to a flaw allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. Jackson-databind is used in our Speech...

CVE-2026-110879

PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation incomplete fix for CVE-2026-54512 CVE-2026-110879 Mitigation Mitigation for this issue is either not available or the currently available options do not meet...

CLEANSTART-2026-BX50217 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...

CLEANSTART-2026-VZ03493 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

CLEANSTART-2026-BX77737 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the kafka package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-KA63622 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the kafka package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-BN64162 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the kafka package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-HK23784 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the kafka package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-QF50624 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the kafka package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

FreeBSD : jackson-databind -- type parameters bypass the polymorphic type validator (8c1b47e2-cf3d-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8c1b47e2-cf3d-11f1-a655-3497f65b111b advisory. The Jackson project reports: Type parameters of generic type ids, and element types of array type ids,...

FreeBSD : jackson-databind -- denial of service (7b3ea5d6-cf3d-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7b3ea5d6-cf3d-11f1-a655-3497f65b111b advisory. The Jackson project reports: CVE-2026-91776: TypeDeserializerBase caches the resolved...

Oracle Primavera Unifier (October 2026 CPU)

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Document Management Spring Framework. Supporte...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in jackson-databind (CVE-2026-59283)

Summary IBM Db2 Developer Extension is affected by vulnerability in jackson-databind CVE-2026-59283 Vulnerability Details CVEID:CVE-2026-59283 DESCRIPTION: Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypa...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms

Summary Multiple vulnerabilities were identified in third-party components and libraries used by CICS Transaction Gateway for Multiplatforms, including libexpat, GNU Debugger, Libevent, Jackson Databind, Jackson Core and Expat. To address these vulnerabilities, the affected components and librari...