Skip to content
OpenAdvisories
High ALSA-2026:85231 1 CVE

Important: jackson-databind security update

Published Oct 19, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.

Security Fix(es):

* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 9 pki-jackson-databind 2.21.6-1.el9_8.1

Vulnerabilities 1

  • High 7.5
    CVE-2026-91777

    jackson-databind: quadratic forward-reference completion in Collection and Map deserializers

    Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolve…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-91777
  • report
    https://bugzilla.redhat.com/2539085
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-85231.html