Description
jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.426.3.1706516352-3.el8 | RHSA-2024:0777 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.14.1706516441-1.el8 | RHSA-2024:0777 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | jackson-core | 2.11.4-7.amzn2023.0.2 | ALAS2023-2023-248 |
Advisories 18
- RHSA-2024:0777 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-0351 Dell NetWorker (Third Party Components): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2023-1480 FasterXML Jackson: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Apr 6, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-3191 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 11, 2026
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2023-2625 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 6, 2025
- WID-SEC-2024-0899 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 9, 2025
- WID-SEC-2024-3684 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 11, 2024
- NCSC-2024-0418 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0417 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0293 Kwetsbaarheden verholpen in Oracle Communications Applications NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1643 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2023-2518 Red Hat JBoss Data Grid: Mehre Schwachstellen BSI CERT-Bund (WID) · Jul 1, 2024
- WID-SEC-2023-2674 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-2673 Oracle Database Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2023
- ALAS2023-2023-248 Important: jackson-core security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2023