Description
This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | com.fasterxml.jackson.dataformat:jackson-dataformat-cbor | < unspecified, unspecified – < 2.11.4, 2.12.0-rc1 – < unspecified, unspecified – < 2.12.1 | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | jackson-dataformat-cbor | 2.7.8-5.1 | — |
| Debian 12 | jackson-dataformat-cbor | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jackson-dataformat-cbor | No fix yet | — |
| Ubuntu 26.04 LTS | jackson-dataformat-cbor | No fix yet | — |
| Ubuntu 25.10 | jackson-dataformat-cbor | No fix yet | — |
| Ubuntu 24.04 LTS | jackson-dataformat-cbor | No fix yet | — |
| Ubuntu 22.04 LTS | jackson-dataformat-cbor | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jackson-dataformat-cbor | No fix yet | — |
| Ubuntu 18.04 LTS | jackson-dataformat-cbor | No fix yet | — |
| Ubuntu 16.04 LTS | jackson-dataformat-cbor | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 9.0.15-1.redhat_00002.1.el6sso | RHSA-2021:3529, RHSA-2021:3528, RHSA-2021:3527 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SLES 15 SP4 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SLES 15 SP4 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SLES 15 SP3 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SLES 15 SP3 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SLES 15 SP3 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SLES 15 SP2 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SLES 15 SP2 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SLES 15 SP2 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP2 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SLES for SAP 15 SP2 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SLES for SAP 15 SP2 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SLE Real Time 15 SP2 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SLE Real Time 15 SP2 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SLE Real Time 15 SP2 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SLE HPC 15 SP2 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SLE HPC 15 SP2 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SLE HPC 15 SP2 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SUSE Manager Server 4.1 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SUSE Manager Server 4.1 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SUSE Manager Server 4.1 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SUSE Manager Retail Branch Server 4.1 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SUSE Manager Retail Branch Server 4.1 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SUSE Manager Retail Branch Server 4.1 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SUSE Manager Proxy 4.1 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SUSE Manager Proxy 4.1 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SUSE Manager Proxy 4.1 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| SUSE Enterprise Storage 7 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| SUSE Enterprise Storage 7 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| SUSE Enterprise Storage 7 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | jackson-bom | 2.13.0-150200.3.3.1 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.4 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.4 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.4 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.3 | jackson-bom | 2.13.0-150200.3.3.1 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.3 | jackson-core +1 | 2.13.0-150200.3.6.1 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.3 | jackson-databind | 2.13.0-150200.3.9.1 | SUSE-SU-2022:1678-1 |
| openSUSE Leap 15.3 | jackson-dataformats-binary | 2.13.0-150200.3.3.3 | SUSE-SU-2022:1678-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.dataformat:jackson-dataformat-cbor | >= 2.8.0rc1, < 2.11.4 | 2.11.4 | GHSA-xmc8-26q4-qjhx |
| Maven | com.fasterxml.jackson.dataformat:jackson-dataformat-cbor | >= 2.12.0rc1, < 2.12.1 | 2.12.1 | GHSA-xmc8-26q4-qjhx |
Advisories 4
- RHSA-2021:3529 Red Hat Security Advisory: Red Hat Single Sign-On 7.4.9 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2021:3527 Red Hat Security Advisory: Red Hat Single Sign-On 7.4.9 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2021:3528 Red Hat Security Advisory: Red Hat Single Sign-On 7.4.9 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 14, 2026
- SUSE-SU-2022:1678-1 Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core SUSE / openSUSE Security Updates · Feb 4, 2026