Skip to content
OpenAdvisories
High · 8.1 Public exploit CVE-2026-54512 EUVD-2026-38595GHSA-j3rv-43j4-c7qm

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

Published Jun 23, 2026 · Updated Jun 24, 2026 · Assigned by GitHub_M

Vendor: FasterXML Product: jackson-databind Package: airflow-3 Package: akhq Package: apache-nifi Package: apache-pulsar-4.2 Package: apache-tika-3.1 Package: apache-tika-3.2 Package: apache-tika-3.2-compat Package: apache-tika-3.3 Package: apicurio-registry Package: cassandra-4.1 Package: cassandra-5.0 Package: cassandra-reaper Package: celeborn-0.6 Package: com.fasterxml.jackson.core:jackson-databind Package: confluent-common-docker Package: confluent-kafka Package: dependency-track Package: dependency-track-bundled Package: druid Package: flyway Package: gradle-8 Package: gradle-9 Package: gradle-stage0 Package: infinispan-16.1 Package: jackson-databind Package: jackson-databind Package: jenkins-2-openjdk-21 Package: jenkins-2-openjdk-25 Package: jenkins-plugin-manager Package: kafka-4.1 Package: kafka-4.2 Package: keycloak-26.4-iamguarded-compat Package: keycloak-26.5 Package: keycloak-26.5-iamguarded-compat Package: keycloak-26.5-operator Package: keycloak-26.6 Package: keycloak-26.6-iamguarded-compat Package: keycloak-26.6-operator Package: keycloak-config-cli Package: keycloak-config-cli-iamguarded-compat Package: kserve-modelmesh Package: logstash-9.3 Package: logstash-9.3-iamguarded-compat Package: logstash-9.4 Package: logstash-9.4-iamguarded-compat Package: management-api-for-apache-cassandra-5.0 Package: neo4j-2026.01 Package: neo4j-2026.05 Package: neo4j-2026.06 Package: neo4j-2026.07 Package: nextflow Package: opensearch-2 Package: opensearch-3 Package: opensearch-3-alerting Package: opensearch-3-anomaly-detection Package: opensearch-3-crypto-kms Package: opensearch-3-discovery-ec2 Package: opensearch-3-iamguarded-compat Package: opensearch-3-ml-commons Package: opensearch-3-neural-search Package: opensearch-3-notifications Package: opensearch-3-observability Package: opensearch-3-performance-analyzer Package: opensearch-3-reporting Package: opensearch-3-repository-azure Package: opensearch-3-repository-s3 Package: opensearch-3-security Package: opensearch-3-sql Package: ruby3.2-jrjackson Package: ruby3.3-jrjackson Package: ruby3.4-jrjackson Package: ruby4.0-jrjackson Package: scala-3.8 Package: solr-10 Package: solr-10-iamguarded-compat Package: sonarqube Package: spark-4.0-scala-2.13 Package: spark-4.1-scala-2.13 Package: spdx-tools-java Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: strimzi-kafka-operator-v1-api-conversion Package: tez Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: tools.jackson.core:jackson-databind Package: trino Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: wavefront-proxy Package: zipkin Package: zipkin-slim Package: zookeeper-3.9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Affected products

VendorProductAffectedFixed
FasterXML jackson-databind >= 2.10.0, < 2.18.8, >= 2.19.0, < 2.21.4, >= 3.0.0, < 3.1.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 jackson-databind 2.18.11-1 —
Debian 13 jackson-databind No fix yet —
Debian 12 jackson-databind No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 jackson-databind No fix yet —
Ubuntu 26.04 LTS jackson-databind No fix yet —
Ubuntu 25.10 jackson-databind No fix yet —
Ubuntu 24.04 LTS jackson-databind No fix yet —
Ubuntu 22.04 LTS jackson-databind No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS jackson-databind No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 dogtag-pki +8 11.9.0-4.el10_2 RHSA-2026:43400
RHEL 9 jackson-databind +1 2.21.4-1.el9_8 RHSA-2026:40895
Show 18 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Satellite Utils 6 rubygem-jwt 2.10.3-1.el8sat RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385
Red Hat Satellite Maintenance 6 ansible-core 1:2.16.19-1.el9sat RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385
Red Hat Satellite Capsule 6 ansible-core +1 1:2.16.19-1.el9sat RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385
Red Hat Satellite Capsule 6 openvox-server 8.15.2-1.el8sat RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385
Red Hat Satellite Capsule 6 pulpcore-obsolete-packages 1.3.1-5.el9pc RHSA-2026:63386
Red Hat Satellite Capsule 6 python-aiohttp +1 3.14.3-1.el8pc RHSA-2026:63387, RHSA-2026:63327
Red Hat Satellite Capsule 6 python3.12-aiohttp 3.14.3-1.el9pc RHSA-2026:63386, RHSA-2026:63385
Red Hat Satellite Capsule 6 python3.12-gitpython 3.1.59-1.el9pc RHSA-2026:63385
Red Hat Satellite Capsule 6 python3.12-pulpcore 3.73.30-3.el9pc RHSA-2026:63386
Red Hat Satellite Capsule 6 rubygem-jwt 2.10.3-1.el8sat RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385
Red Hat Satellite 6 ansible-core +1 1:2.16.19-1.el9sat RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385
Red Hat Satellite 6 openvox-server 8.15.2-1.el8sat RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385
Red Hat Satellite 6 pulpcore-obsolete-packages 1.3.1-5.el9pc RHSA-2026:63386
Red Hat Satellite 6 python-aiohttp +1 3.14.3-1.el8pc RHSA-2026:63387, RHSA-2026:63327
Red Hat Satellite 6 python3.12-aiohttp 3.14.3-1.el9pc RHSA-2026:63386, RHSA-2026:63385
Red Hat Satellite 6 python3.12-gitpython 3.1.59-1.el9pc RHSA-2026:63385
Red Hat Satellite 6 python3.12-pulpcore 3.73.30-3.el9pc RHSA-2026:63386
Red Hat Satellite 6 rubygem-jwt 2.10.3-1.el8sat RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385
Red Hat Single Sign On 7 rh-sso7-keycloak +1 18.0.20-1.redhat_00001.1.el7sso RHSA-2026:76130, RHSA-2026:76129, RHSA-2026:76128
RHEL 10.0 EUS dogtag-pki +8 11.6.0-2.el10_0 RHSA-2026:44271
RHEL 9.6 EUS jackson-databind +1 2.21.4-1.el9_6 RHSA-2026:44064
RHEL 9.4 E4S jackson-databind +1 2.21.4-1.el9_4 RHSA-2026:44065
RHEL 9.2 E4S jackson-databind +1 2.21.4-1.el9_2 RHSA-2026:44063
RHEL 8.8 TUS apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:44066
RHEL 8.8 TUS bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS fasterxml-oss-parent 75-1.module+el8.8.0+24520+bae56b06 RHSA-2026:44066
RHEL 8.8 TUS glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS jackson-bom +6 2.21.4-1.module+el8.8.0+24520+bae56b06 RHSA-2026:44066
RHEL 8.8 TUS jackson-parent +1 2.21-1.module+el8.8.0+24520+bae56b06 RHSA-2026:44066
RHEL 8.8 TUS jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS pki-servlet-engine 1:9.0.62-1.module+el8.8.0+22367+4894538d RHSA-2026:44066
RHEL 8.8 TUS python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS resteasy 3.0.26-7.module+el8.8.0+22365+b433a336 RHSA-2026:44066
RHEL 8.8 TUS slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:44066
RHEL 8.8 TUS velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 TUS xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:44066
RHEL 8.8 TUS xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:44066
RHEL 8.8 E4S bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S fasterxml-oss-parent 75-1.module+el8.8.0+24520+bae56b06 RHSA-2026:44066
RHEL 8.8 E4S glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S jackson-bom +6 2.21.4-1.module+el8.8.0+24520+bae56b06 RHSA-2026:44066
RHEL 8.8 E4S jackson-parent +1 2.21-1.module+el8.8.0+24520+bae56b06 RHSA-2026:44066
RHEL 8.8 E4S jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S pki-servlet-engine 1:9.0.62-1.module+el8.8.0+22367+4894538d RHSA-2026:44066
RHEL 8.8 E4S python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S resteasy 3.0.26-7.module+el8.8.0+22365+b433a336 RHSA-2026:44066
RHEL 8.8 E4S slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:44066
RHEL 8.8 E4S velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.8 E4S xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:44066
RHEL 8.8 E4S xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:44066
RHEL 8.6 EUS Long Life apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:44061
RHEL 8.6 EUS Long Life bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life fasterxml-oss-parent 75-1.module+el8.6.0+24530+83fbd25a RHSA-2026:44061
RHEL 8.6 EUS Long Life glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life jackson-bom +6 2.21.4-1.module+el8.6.0+24530+83fbd25a RHSA-2026:44061
RHEL 8.6 EUS Long Life jackson-parent +1 2.21-1.module+el8.6.0+24530+83fbd25a RHSA-2026:44061
RHEL 8.6 EUS Long Life jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life pki-servlet-engine +1 1:9.0.30-3.module+el8.6.0+23938+b3b8726f.3 RHSA-2026:44061
RHEL 8.6 EUS Long Life python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life resteasy 3.0.26-6.module+el8.6.0+23400+aafc0b27 RHSA-2026:44061
RHEL 8.6 EUS Long Life slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:44061
RHEL 8.6 EUS Long Life velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 EUS Long Life xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:44061
RHEL 8.6 EUS Long Life xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:44061
RHEL 8.6 AUS bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS fasterxml-oss-parent 75-1.module+el8.6.0+24530+83fbd25a RHSA-2026:44061
RHEL 8.6 AUS glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS jackson-bom +6 2.21.4-1.module+el8.6.0+24530+83fbd25a RHSA-2026:44061
RHEL 8.6 AUS jackson-parent +1 2.21-1.module+el8.6.0+24530+83fbd25a RHSA-2026:44061
RHEL 8.6 AUS jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS pki-servlet-engine +1 1:9.0.30-3.module+el8.6.0+23938+b3b8726f.3 RHSA-2026:44061
RHEL 8.6 AUS python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS resteasy 3.0.26-6.module+el8.6.0+23400+aafc0b27 RHSA-2026:44061
RHEL 8.6 AUS slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:44061
RHEL 8.6 AUS velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.6 AUS xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:44061
RHEL 8.6 AUS xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:44061
RHEL 8.4 EUS Long Life apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:44062
RHEL 8.4 EUS Long Life bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life fasterxml-oss-parent 75-1.module+el8.4.0+24531+dcbbef34 RHSA-2026:44062
RHEL 8.4 EUS Long Life glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life jackson-bom +6 2.21.4-1.module+el8.4.0+24531+dcbbef34 RHSA-2026:44062
RHEL 8.4 EUS Long Life jackson-parent +1 2.21-1.module+el8.4.0+24531+dcbbef34 RHSA-2026:44062
RHEL 8.4 EUS Long Life jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life pki-servlet-engine +1 1:9.0.30-1.module+el8.4.0+23942+fa6501e9.3 RHSA-2026:44062
RHEL 8.4 EUS Long Life python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life resteasy 3.0.26-6.module+el8.4.0+23399+fc91639f RHSA-2026:44062
RHEL 8.4 EUS Long Life slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:44062
RHEL 8.4 EUS Long Life velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 EUS Long Life xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:44062
RHEL 8.4 EUS Long Life xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS apache-commons-collections 3.2.2-10.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS apache-commons-lang 2.6-21.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS apache-commons-net 3.6-3.module+el8.3.0+6805+72837426 RHSA-2026:44062
RHEL 8.4 AUS bea-stax +1 1.2.0-16.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS fasterxml-oss-parent 75-1.module+el8.4.0+24531+dcbbef34 RHSA-2026:44062
RHEL 8.4 AUS glassfish-fastinfoset 1.2.13-9.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS glassfish-jaxb +3 2.2.11-11.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS glassfish-jaxb-api 2.2.12-8.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS jackson-bom +6 2.21.4-1.module+el8.4.0+24531+dcbbef34 RHSA-2026:44062
RHEL 8.4 AUS jackson-parent +1 2.21-1.module+el8.4.0+24531+dcbbef34 RHSA-2026:44062
RHEL 8.4 AUS jakarta-commons-httpclient 1:3.1-28.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS javassist +1 3.18.1-8.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS pki-servlet-engine +1 1:9.0.30-1.module+el8.4.0+23942+fa6501e9.3 RHSA-2026:44062
RHEL 8.4 AUS python-nss +2 1.0.1-10.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS relaxngDatatype 2011.1-7.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS resteasy 3.0.26-6.module+el8.4.0+23399+fc91639f RHSA-2026:44062
RHEL 8.4 AUS slf4j +1 1.7.25-4.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS stax-ex 1.7.7-8.module+el8.2.0+5723+4574fbff RHSA-2026:44062
RHEL 8.4 AUS velocity 1.7-24.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS xalan-j2 2.7.1-38.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS xerces-j2 2.11.0-34.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS xml-commons-apis 1.4.01-25.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS xml-commons-resolver 1.2-26.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
RHEL 8.4 AUS xmlstreambuffer 1.5.4-8.module+el8.2.0+5723+4574fbff RHSA-2026:44062
RHEL 8.4 AUS xsom 0-19.20110809svn.module+el8.1.0+3366+6dfb954c RHSA-2026:44062
Red Hat Jboss Enterprise Application Platform Els 7 eap7-activemq-artemis +15 2.16.0-22.redhat_00057.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-glassfish-jsf 2.3.14-11.SP11_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-ironjacamar +8 1.5.26-2.Final_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jackson-core +10 2.18.8-1.redhat_00003.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jboss-remoting 5.0.31-3.SP2_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jboss-server-migration +2 1.10.0-46.Final_redhat_00044.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-netty +26 4.1.135-1.Final_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-picketlink-api +7 2.5.5-24.SP12_redhat_00016.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-picketlink-bindings +1 2.5.5-30.SP12_redhat_00020.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-undertow 2.2.40-1.SP3_redhat_00001.1.el8eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly +4 7.4.25-2.GA_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly-java-jdk17 7.4.25-2.GA_redhat_00001.1.el8eap RHSA-2026:53646, RHSA-2026:53645
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.40.0-8.redhat_00024.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.1.7-1.SP1_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-artemis-wildfly-integration 2.0.5-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-bouncycastle +5 1.85.0-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-cryptacular 1.2.7-1.redhat_00002.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 801.8.0-1.GA_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-hibernate +2 6.6.54-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-httpcomponents-asyncclient 4.1.5-5.redhat_00008.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-ironjacamar +8 3.0.22-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jackson-core +12 2.18.9-1.redhat_00003.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jakarta-xml-bind-api 4.0.5-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jaxb +9 4.0.7-4.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jaxbintros 2.1.0-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jboss-logging 3.6.3-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jboss-remoting 5.0.31-1.SP2_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-api 3.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-common-tools 2.2.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-cxf 7.4.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-jaxws-undertow-httpspi 3.0.1-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-spi 5.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jsf-impl 4.0.11-2.SP1_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-log4j 2.25.4-1.redhat_00003.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-neethi 3.2.2-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-netty +14 4.1.136-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-nimbus-jose-jwt 9.37.4-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-parsson 1.1.9-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-saaj-impl +1 3.0.6-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.18-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-undertow 2.3.26-2.SP3_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly +3 8.1.8-9.GA_redhat_00006.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly-elytron +1 2.6.11-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly-javadocs 8.1.1-12.GA_redhat_00048.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-ws-commons-XmlSchema 2.3.2-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat Certificate System 10 jss +4 5.9.1-2.module+el8pki+24483+db4528cf RHSA-2026:48095
Red Hat Certificate System 10 ldapjdk +2 5.6.0-3.module+el8pki+24228+5326976e RHSA-2026:48095
Red Hat Certificate System 10 redhat-pki +16 11.9.2-4.module+el8pki+24565+7517ad63 RHSA-2026:48095

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 idm-pki-ca +7 11.9.0-4.el10_2.alma.1 ALSA-2026:43400
AlmaLinux 9 pki-jackson-annotations 2.21-1.el9_8 ALSA-2026:40895
AlmaLinux 9 pki-jackson-core +4 2.21.4-1.el9_8 ALSA-2026:40895

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 dogtag-pki 11.9.0-4.el10_2.rocky.0.1 RLSA-2026:43400
Rocky Linux 9 jackson-annotations 2.21-1.el9_8 RLSA-2026:40895
Rocky Linux 9 jackson-core +3 2.21.4-1.el9_8 RLSA-2026:40895

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES 15 SP7 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES 15 SP7 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLES 15 SP6 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES 15 SP6 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES 15 SP6 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLES 15 SP5 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES 15 SP5 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES 15 SP5 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLES 15 SP4 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES 15 SP4 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES 15 SP4 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 jackson-core +2 2.18.8-160000.1.1 SUSE-SU-2026:22504-1
SLES for SAP 15 SP6 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES for SAP 15 SP6 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES for SAP 15 SP6 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLES for SAP 15 SP5 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES for SAP 15 SP5 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES for SAP 15 SP5 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLES for SAP 15 SP4 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES for SAP 15 SP4 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES for SAP 15 SP4 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLES 16.0 jackson-core +2 2.18.8-160000.1.1 SUSE-SU-2026:22504-1
SLE HPC 15 SP5 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLE HPC 15 SP5 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLE HPC 15 SP5 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLE HPC 15 SP4 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLE HPC 15 SP4 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLE HPC 15 SP4 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed jackson-databind 2.18.8-2.1 openSUSE-SU-2026:11132-1
openSUSE Leap 16.0 jackson-core +2 2.18.8-160000.1.1 openSUSE-SU-2026:21201-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 jackson-databind 2.16.1-4.amzn2023.0.2 ALAS2023-2026-1947

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 idm-pki-ca +7 11.9.0-4.0.1.el10_2 ELSA-2026-43400
Oracle Linux 9 pki-jackson-annotations 2.21-1.el9_8 ELSA-2026-40895
Oracle Linux 9 pki-jackson-core +4 2.21.4-1.el9_8 ELSA-2026-40895

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling airflow-3 3.3.0-r3 —
Wolfi rolling akhq 0.27.1-r5 —
Wolfi rolling apache-nifi +5 No fix yet —
Wolfi rolling apache-pulsar-4.2 4.2.3-r1 —
Wolfi rolling apache-tika-3.1 3.1.0-r33 —
Wolfi rolling apache-tika-3.2 3.2.3-r13 —
Wolfi rolling apache-tika-3.2-compat 3.2.3-r18 —
Wolfi rolling apache-tika-3.3 3.3.1-r5 —
Wolfi rolling apicurio-registry 3.3.0-r6 —
Wolfi rolling cassandra-4.1 4.1.11-r1 —
Wolfi rolling cassandra-5.0 5.0.8-r7 —
Wolfi rolling cassandra-reaper 4.2.5-r3 —
Wolfi rolling celeborn-0.6 0.6.3-r9 —
Wolfi rolling confluent-common-docker 7.6.9-r6 —
Wolfi rolling confluent-kafka 8.4.0.253-r2 —
Wolfi rolling dependency-track +1 4.14.2-r3 —
Wolfi rolling druid 37.0.0-r14 —
Wolfi rolling flyway 12.9.0-r1 —
Wolfi rolling gradle-8 8.14.5-r1 —
Wolfi rolling gradle-9 9.6.1-r1 —
Wolfi rolling infinispan-16.1 16.1.4-r5 —
Wolfi rolling jenkins-2-openjdk-21 +1 2.572-r0 —
Wolfi rolling jenkins-plugin-manager 2.15.0-r4 —
Wolfi rolling kafka-4.1 4.1.2-r3 —
Wolfi rolling kafka-4.2 4.2.1-r3 —
Wolfi rolling keycloak-26.5 +2 26.5.7-r8 —
Wolfi rolling keycloak-26.6 +2 26.6.4-r1 —
Wolfi rolling keycloak-config-cli +1 6.5.1-r5 —
Wolfi rolling kserve-modelmesh 0.12.0-r36 —
Wolfi rolling logstash-9.3 +1 9.3.8-r0 —
Wolfi rolling logstash-9.4 +1 9.4.2-r7 —
Wolfi rolling management-api-for-apache-cassandra-5.0 0.1.122-r1 —
Wolfi rolling neo4j-2026.05 2026.05.0-r4 —
Wolfi rolling nextflow 26.04.4-r1 —
Wolfi rolling opensearch-2 2.19.6-r0 —
Wolfi rolling opensearch-3 +14 3.7.0-r2 —
Wolfi rolling opensearch-3-iamguarded-compat 3.8.0-r3 —
Wolfi rolling ruby3.2-jrjackson +2 0.5.2-r0 —
Wolfi rolling ruby4.0-jrjackson 0.5.0-r1 —
Wolfi rolling scala-3.8 3.8.4-r4 —
Wolfi rolling solr-10 +1 10.0.0-r6 —
Wolfi rolling sonarqube 26.8.0.126808-r0 —
Wolfi rolling spark-4.0-scala-2.13 4.0.3-r2 —
Wolfi rolling spark-4.1-scala-2.13 4.1.2-r5 —
Wolfi rolling spdx-tools-java 2.0.6-r5 —
Wolfi rolling strimzi-kafka-operator-kafka-init +8 1.0.1-r2 —
Wolfi rolling tez 0.10.5-r17 —
Wolfi rolling thingsboard-tb-node +1 4.3.1.2-r12 —
Wolfi rolling trino +53 482-r0 —
Wolfi rolling trino-plugin-teradata-functions 483-r7 —
Wolfi rolling wavefront-proxy 13.9-r21 —
Wolfi rolling zipkin +1 3.6.1-r15 —
Wolfi rolling zookeeper-3.9 3.9.5-r8 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.fasterxml.jackson.core:jackson-databind >= 2.10.0, < 2.18.8 2.18.8 GHSA-j3rv-43j4-c7qm
Maven com.fasterxml.jackson.core:jackson-databind >= 3.0.0, < 3.1.4 3.1.4 GHSA-j3rv-43j4-c7qm
Maven com.fasterxml.jackson.core:jackson-databind >= 2.19.0, < 2.21.4 2.21.4 GHSA-j3rv-43j4-c7qm
Maven tools.jackson.core:jackson-databind >= 3.0.0, < 3.1.4 3.1.4 GHSA-j3rv-43j4-c7qm

Advisories 48

References