Description
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.9.8-1 | — |
| Debian 13 | jackson-databind | 2.9.8-1 | — |
| Debian 12 | jackson-databind | 2.9.8-1 | — |
| Debian 9 | jackson-databind | 2.8.6-1+deb9u5 | DSA-4452-1 |
| Debian 8 | jackson-databind | 2.4.2-2+deb8u5 | DLA-1703-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm2 | USN-4813-1 |
| Ubuntu Pro 14.04 LTS | jackson-databind | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-maven35-jackson-databind +1 | 2.7.6-2.5.el7 | RHSA-2019:0782 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.9.0, < 2.9.8 | 2.9.8 | GHSA-f9hv-mg5h-xcw9 |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.8.0, < 2.8.11.3 | 2.8.11.3 | GHSA-f9hv-mg5h-xcw9 |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.7.0, < 2.7.9.5 | 2.7.9.5 | GHSA-f9hv-mg5h-xcw9 |
Advisories 6
- USN-4813-1 jackson-databind vulnerabilities Ubuntu Security Notices (USN) · Oct 12, 2026
- RHSA-2019:0782 Red Hat Security Advisory: rh-maven35-jackson-databind security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-4452-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1703-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-1682 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2024
References
- https://github.com/FasterXML/jackson-databind/issues/2186
- [debian-lts-announce] 20190304 [SECURITY] [DLA 1703-1] jackson-databind security update mailing-list
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8
- https://issues.apache.org/jira/browse/TINKERPOP-2121
- https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
- [infra-devnull] 20190329 [GitHub] [pulsar] massakam opened pull request #3938: Upgrade third party libraries with security vulnerabilities mailing-list
- [pulsar-commits] 20190329 [GitHub] [pulsar] massakam opened a new pull request #3938: Upgrade third party libraries with security vulnerabilities mailing-list
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- RHSA-2019:0782 vendor-advisory
- RHSA-2019:0877 vendor-advisory
- RHBA-2019:0959 vendor-advisory
- DSA-4452 vendor-advisory
- 20190527 [SECURITY] [DSA 4452-1] jackson-databind security update mailing-list
- https://security.netapp.com/advisory/ntap-20190530-0003/
- RHSA-2019:1782 vendor-advisory
- RHSA-2019:1797 vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- 107985 vdb-entry
- RHSA-2019:1822 vendor-advisory
- RHSA-2019:1823 vendor-advisory
- RHSA-2019:2804 vendor-advisory
- RHSA-2019:2858 vendor-advisory
- RHSA-2019:3002 vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- RHSA-2019:3140 vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- RHSA-2019:3149 vendor-advisory
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html mailing-list
- RHSA-2019:3892 vendor-advisory
- RHSA-2019:4037 vendor-advisory
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image mailing-list
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 mailing-list