Description
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.9.8-1 | — |
| Debian 13 | jackson-databind | 2.9.8-1 | — |
| Debian 12 | jackson-databind | 2.9.8-1 | — |
| Debian 9 | jackson-databind | 2.8.6-1+deb9u5 | DSA-4452-1 |
| Debian 8 | jackson-databind | 2.4.2-2+deb8u5 | DLA-1703-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm2 | USN-4813-1 |
| Ubuntu Pro 14.04 LTS | jackson-databind | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-maven35-jackson-databind +1 | 2.7.6-2.5.el7 | RHSA-2019:0782 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.7.0, < 2.7.9.5 | 2.7.9.5 | GHSA-mx9v-gmh4-mgqw |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.9.0, < 2.9.8 | 2.9.8 | GHSA-mx9v-gmh4-mgqw |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.8.0, < 2.8.11.3 | 2.8.11.3 | GHSA-mx9v-gmh4-mgqw |
Advisories 6
- USN-4813-1 jackson-databind vulnerabilities Ubuntu Security Notices (USN) · Oct 12, 2026
- RHSA-2019:0782 Red Hat Security Advisory: rh-maven35-jackson-databind security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-4452-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1703-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-1682 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2024
References
- https://github.com/FasterXML/jackson-databind/issues/2186
- [debian-lts-announce] 20190304 [SECURITY] [DLA 1703-1] jackson-databind security update mailing-list
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8
- https://issues.apache.org/jira/browse/TINKERPOP-2121
- https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
- [infra-devnull] 20190329 [GitHub] [pulsar] massakam opened pull request #3938: Upgrade third party libraries with security vulnerabilities mailing-list
- [pulsar-commits] 20190329 [GitHub] [pulsar] massakam opened a new pull request #3938: Upgrade third party libraries with security vulnerabilities mailing-list
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- RHSA-2019:0782 vendor-advisory
- RHSA-2019:0877 vendor-advisory
- RHBA-2019:0959 vendor-advisory
- DSA-4452 vendor-advisory
- 20190527 [SECURITY] [DSA 4452-1] jackson-databind security update mailing-list
- https://security.netapp.com/advisory/ntap-20190530-0003/
- RHSA-2019:1782 vendor-advisory
- RHSA-2019:1797 vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- 107985 vdb-entry
- RHSA-2019:1822 vendor-advisory
- RHSA-2019:1823 vendor-advisory
- RHSA-2019:2804 vendor-advisory
- RHSA-2019:2858 vendor-advisory
- RHSA-2019:3002 vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- RHSA-2019:3140 vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- RHSA-2019:3149 vendor-advisory
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html mailing-list
- RHSA-2019:3892 vendor-advisory
- RHSA-2019:4037 vendor-advisory
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image mailing-list
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 mailing-list