Security Bulletin:Vulnerability in jackson-dataformat-cbor may affect IBM Infosphere Change Data Capture (CVE-2026-68495)

Summary A security vulnerability has been identified in jackson-dataformat-cbor, . is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability Details CVEID:CVE-2026-68495 DESCRIPTION: T...

ch.rasc:wamp2spring-core (4.0.1), ch.rasc:wamp2spring-reactive (4.0.1) +419 more potentially affected by CVE-2026-106554 via tools.jackson.dataformat:jackson-dataformat-cbor (>=3.2.0, <=3.2.3)

tools.jackson.dataformat:jackson-dataformat-cbor MAVEN version =3.2.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.1 and more Source cves: CVE-2026-106554 Source advisory: MEND:CVE-2026-106554...

ai.tock:bot-test (>=24.9.0, <=26.3.4), ai.tock:bot-test-base (>=24.9.0, <=26.3.4) +3092 more potentially affected by CVE-2026-106554 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.15.0-rc1, <=2.18.11)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.15.0-rc1, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.5, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =26.3.4 and more Source cves: CVE-2026-106554 Source advisory:...

ai.badmonkey.agentspaces:agentspaces-a2a (>=0.2.0, <=0.4.0), ai.badmonkey.agentspaces:agentspaces-agent (>=0.2.0, <=0.4.0) +1947 more potentially affected by CVE-2026-106554 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.19.0-rc2, <=2.21.7)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.19.0-rc2, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.3.0, =0.4.0 and more Source cves: CVE-2026-106554 Source advisory: MEND:CVE-2026-106554...

ai.tock:tock-nlp-build-model-worker (26.9.0), ai.tock:tock-nlp-build-model-worker-on-aws-batch (26.9.0) +261 more potentially affected by CVE-2026-106554 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.22.0, <=2.22.3)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.22.0, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.22.0, =2.22.3 and more Source cves: CVE-2026-106554 Source advisory: MEND:CVE-2026-106554...

DoS (Denial of Service) com.fasterxml.jackson.dataformat:jackson-dataformat-cbor, tools.jackson.dataformat:jackson-dataformat-cbor Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

DoS (Denial of Service) com.fasterxml.jackson.dataformat:jackson-dataformat-cbor, tools.jackson.dataformat:jackson-dataformat-cbor Dependency in Confluence Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

DoS (Denial of Service) com.fasterxml.jackson.dataformat:jackson-dataformat-cbor Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.0 and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticate...

DoS (Denial of Service) com.fasterxml.jackson.dataformat:jackson-dataformat-cbor Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.0 and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker...

RHLW-2026-56415B28EA79906A Lightwell Security Advisory: jackson-dataformat-cbor 2.9.10.rhlw-00001

Red Hat Lightwell has released com.fasterxml.jackson.dataformat:jackson-dataformat-cbor 2.9.10.rhlw-00001 with a backported security fix. CVE-2020-28491: This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1...

RHLW-2026-2324B17F545E0135 Lightwell Security Advisory: jackson-dataformat-cbor 2.10.0.rhlw-00001

Red Hat Lightwell has released com.fasterxml.jackson.dataformat:jackson-dataformat-cbor 2.10.0.rhlw-00001 with a backported security fix. CVE-2020-28491: This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1...

ai.tock:bot-test (>=24.9.0, <=26.3.4), ai.tock:bot-test-base (>=24.9.0, <=26.3.4) +2476 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.16.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.5, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =26.3.4 and more Source cves: CVE-2026-68495 Source advisory:...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-checkpoint-git_3 (>=0.3.0, <=0.5.7) +1846 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.19.0-rc2, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.19.0-rc2, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.5.7 - ai.fastllm:runtime-roster3 0.5.7 - app.perawallet.xhdwalletapi:xhdwalletapi-shared 1.2.0 and more...

com.amazonaws:athena-aws-cmdb (>=2026.28.1, <=2026.40.1), com.amazonaws:athena-cloudwatch (>=2026.28.1, <=2026.40.1) +196 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.22.0, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.22.0, =2.22.0, =0.11.0, =0.132.0, =0.142.0 and more Source cves: CVE-2026-68495 Source advisory:...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-checkpoint-git_3 (>=0.3.0, <=0.5.7) +1846 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.19.0, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.19.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.5.7 - ai.fastllm:runtime-roster3 0.5.7 - app.perawallet.xhdwalletapi:xhdwalletapi-shared 1.2.0 and more Source...

ai.tock:bot-test (>=24.9.0, <=26.3.4), ai.tock:bot-test-base (>=24.9.0, <=26.3.4) +2476 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.16.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.5, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =26.3.4 and more Source cves: CVE-2026-68495 Source advisory: MEND:CVE-2026-68495...

com.amazonaws:athena-aws-cmdb (>=2026.28.1, <=2026.40.1), com.amazonaws:athena-cloudwatch (>=2026.28.1, <=2026.40.1) +196 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.22.0, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.22.0, =2.22.0, =0.11.0, =0.132.0, =0.142.0 and more Source cves: CVE-2026-68495 Source advisory: MEND:CVE-2026-684...

OPENSUSE-SU-2026:11878-1 jackson-dataformat-cbor-2.18.11-1.1 on GA media

These are all security issues fixed in the jackson-dataformat-cbor-2.18.11-1.1 package on the GA media of openSUSE Tumbleweed...