Description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.11.1-1 | — |
| Debian 13 | jackson-databind | 2.11.1-1 | — |
| Debian 12 | jackson-databind | 2.11.1-1 | — |
| Debian 8 | jackson-databind | 2.4.2-2+deb8u14 | DLA-2179-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jackson-databind | No fix yet | — |
| Ubuntu 18.04 LTS | jackson-databind | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm2 | USN-4813-1 |
| Ubuntu Pro 14.04 LTS | jackson-databind | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-maven35-jackson-databind +1 | 2.7.6-2.10.el7 | RHSA-2020:2320 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.9.0, < 2.9.10.4 | 2.9.10.4 | GHSA-h4rc-386g-6m85 |
Advisories 5
- USN-4813-1 jackson-databind vulnerabilities Ubuntu Security Notices (USN) · Oct 12, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2020:2320 Red Hat Security Advisory: rh-maven35-jackson-databind security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DLA-2179-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2024-2181 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
References
- [debian-lts-announce] 20200417 [SECURITY] [DLA 2179-1] jackson-databind security update mailing-list
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.netapp.com/advisory/ntap-20200511-0004/
- https://github.com/FasterXML/jackson-databind/issues/2682
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html