Description
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.9.8-1 | — |
| Debian 13 | jackson-databind | 2.9.8-1 | — |
| Debian 12 | jackson-databind | 2.9.8-1 | — |
| Debian 9 | jackson-databind | 2.8.6-1+deb9u5 | DSA-4452-1 |
| Debian 8 | jackson-databind | 2.4.2-2+deb8u5 | DLA-1703-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm2 | USN-4813-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-maven35-jackson-databind +1 | 2.7.6-2.5.el7 | RHSA-2019:0782 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.9.0, < 2.9.7 | 2.9.7 | GHSA-4gq5-ch57-c2mg |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.8.0, < 2.8.11.3 | 2.8.11.3 | GHSA-4gq5-ch57-c2mg |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.0.0, < 2.7.9.5 | 2.7.9.5 | GHSA-4gq5-ch57-c2mg |
Advisories 6
- USN-4813-1 jackson-databind vulnerabilities Ubuntu Security Notices (USN) · Oct 12, 2026
- RHSA-2019:0782 Red Hat Security Advisory: rh-maven35-jackson-databind security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-4452-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1703-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-1682 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2024
References
- https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
- https://github.com/FasterXML/jackson-databind/issues/2097
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7
- [debian-lts-announce] 20190304 [SECURITY] [DLA 1703-1] jackson-databind security update mailing-list
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- RHSA-2019:0782 vendor-advisory
- RHSA-2019:0877 vendor-advisory
- RHBA-2019:0959 vendor-advisory
- DSA-4452 vendor-advisory
- 20190527 [SECURITY] [DSA 4452-1] jackson-databind security update mailing-list
- https://security.netapp.com/advisory/ntap-20190530-0003/
- RHSA-2019:1782 vendor-advisory
- RHSA-2019:1797 vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- RHSA-2019:1822 vendor-advisory
- RHSA-2019:1823 vendor-advisory
- RHSA-2019:2804 vendor-advisory
- RHSA-2019:2858 vendor-advisory
- RHSA-2019:3002 vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- RHSA-2019:3140 vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- RHSA-2019:3149 vendor-advisory
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- RHSA-2019:3892 vendor-advisory
- RHSA-2019:4037 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 mailing-list