Skip to content
OpenAdvisories
High ELSA-2026-85231 1 CVE

Important: jackson-databind security update (Oracle Linux 9)

Published Oct 19, 2026 · Updated Oct 19, 2026

Ecosystem: Oracle Linux

Summary

[2.21.6-1.1]
- Resolves: RHEL-276419
- Fix CVE-2026-91777

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 pki-jackson-databind 0:2.21.6-1.el9_8.1

Vulnerabilities 1

  • High 7.5
    CVE-2026-91777

    jackson-databind: quadratic forward-reference completion in Collection and Map deserializers

    Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolve…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven