Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FasterXML | jackson-databind | >= 2.10.0, < 2.14.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.14.0-1 | — |
| Debian 13 | jackson-databind | 2.14.0-1 | — |
| Debian 12 | jackson-databind | 2.14.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jackson-databind | No fix yet | — |
| Ubuntu 25.10 | jackson-databind | No fix yet | — |
| Ubuntu 22.04 LTS | jackson-databind | No fix yet | — |
| Ubuntu 20.04 LTS | jackson-databind | No fix yet | — |
| Ubuntu 18.04 LTS | jackson-databind | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | No fix yet | — |
| Ubuntu Pro 14.04 LTS | jackson-databind | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.20-1.redhat_00001.1.el7sso | RHSA-2026:76130, RHSA-2026:76129, RHSA-2026:76128 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-activemq-artemis +15 | 2.16.0-22.redhat_00057.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-glassfish-jsf | 2.3.14-11.SP11_redhat_00001.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-ironjacamar +8 | 1.5.26-2.Final_redhat_00001.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jackson-core +10 | 2.18.8-1.redhat_00003.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-remoting | 5.0.31-3.SP2_redhat_00001.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-server-migration +2 | 1.10.0-46.Final_redhat_00044.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-netty +26 | 4.1.135-1.Final_redhat_00001.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-picketlink-api +7 | 2.5.5-24.SP12_redhat_00016.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-picketlink-bindings +1 | 2.5.5-30.SP12_redhat_00020.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-undertow | 2.2.40-2.SP3_redhat_00001.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly +4 | 7.4.25-2.GA_redhat_00001.1.el7eap | RHSA-2026:53644 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | jackson-databind | 2.14.2-1.amzn2023.0.1 | ALAS2023-2026-1949 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | celeborn-0.6 | No fix yet | — |
| Wolfi rolling | druid | 37.0.0-r14 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.3-r2 | — |
| Wolfi rolling | spark-4.1-scala-2.13 | 4.1.2-r5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.10.0, < 2.14.0 | 2.14.0 | GHSA-3wrr-7qpf-2prh |
Advisories 6
- WID-SEC-2026-2058 FasterXML Jackson: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- RHSA-2026:76130 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76129 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76128 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:53644 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ALAS2023-2026-1949 Moderate: jackson-databind security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2026