High DLA-2406-1 1 CVE

jackson-databind - security update

Published Oct 14, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 9	jackson-databind	2.8.6-1+deb9u8

Vulnerabilities 1

High 7.5

CVE-2020-25649 EPSS 18%

XML External Entity (XXE) Injection in Jackson Databind

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Dec 3, 2020