Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FasterXML | jackson-databind | >= 2.10.0, < 2.18.8, >= 2.19.0, < 2.21.4, >= 3.0.0, < 3.1.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.18.11-1 | — |
| Debian 13 | jackson-databind | No fix yet | — |
| Debian 12 | jackson-databind | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jackson-databind | No fix yet | — |
| Ubuntu 26.04 LTS | jackson-databind | No fix yet | — |
| Ubuntu 25.10 | jackson-databind | No fix yet | — |
| Ubuntu 24.04 LTS | jackson-databind | No fix yet | — |
| Ubuntu 22.04 LTS | jackson-databind | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jackson-databind | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | dogtag-pki +8 | 11.9.0-4.el10_2 | RHSA-2026:43400 |
| RHEL 9 | jackson-databind +1 | 2.21.4-1.el9_8 | RHSA-2026:40895 |
| RHEL 8 | apache-commons-collections | 3.2.2-10.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | apache-commons-lang | 2.6-21.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | apache-commons-net | 3.6-3.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | bea-stax +1 | 1.2.0-16.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | glassfish-jaxb +3 | 2.2.11-12.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.10.0+21035+a01f6469 | RHSA-2026:43218 |
| RHEL 8 | jackson-annotations | 2.21-1.module+el8.10.0+24523+f75fb079 | RHSA-2026:43218 |
| RHEL 8 | jackson-core +3 | 2.21.4-1.module+el8.10.0+24523+f75fb079 | RHSA-2026:43218 |
| RHEL 8 | jackson-modules-base +1 | 2.21.4-2.module+el8.10.0+24523+f75fb079 | RHSA-2026:43218 |
| RHEL 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | javassist +1 | 3.18.1-8.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | pki-servlet-engine | 1:9.0.62-1.module+el8.10.0+21257+2b5308b5 | RHSA-2026:43218 |
| RHEL 8 | relaxngDatatype | 2011.1-7.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | slf4j +1 | 1.7.25-4.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | stax-ex | 1.7.7-8.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | velocity | 1.7-24.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | xalan-j2 | 2.7.1-38.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | xerces-j2 | 2.11.0-34.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | xml-commons-apis | 1.4.01-25.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | xml-commons-resolver | 1.2-26.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | xmlstreambuffer | 1.5.4-8.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
| RHEL 8 | xsom | 0-19.20110809svn.module+el8.10.0+20993+d0f024b0 | RHSA-2026:43218 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | dogtag-pki +8 | 11.6.0-2.el10_0 | RHSA-2026:44271 |
| RHEL 9.6 EUS | jackson-databind +1 | 2.21.4-1.el9_6 | RHSA-2026:44064 |
| RHEL 9.4 E4S | jackson-databind +1 | 2.21.4-1.el9_4 | RHSA-2026:44065 |
| RHEL 9.2 E4S | jackson-databind +1 | 2.21.4-1.el9_2 | RHSA-2026:44063 |
| RHEL 8.8 TUS | apache-commons-collections | 3.2.2-10.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | apache-commons-lang | 2.6-21.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | apache-commons-net | 3.6-3.module+el8.3.0+6805+72837426 | RHSA-2026:44066 |
| RHEL 8.8 TUS | bea-stax +1 | 1.2.0-16.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | fasterxml-oss-parent | 75-1.module+el8.8.0+24520+bae56b06 | RHSA-2026:44066 |
| RHEL 8.8 TUS | glassfish-fastinfoset | 1.2.13-9.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | glassfish-jaxb +3 | 2.2.11-11.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | glassfish-jaxb-api | 2.2.12-8.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | jackson-bom +6 | 2.21.4-1.module+el8.8.0+24520+bae56b06 | RHSA-2026:44066 |
| RHEL 8.8 TUS | jackson-parent +1 | 2.21-1.module+el8.8.0+24520+bae56b06 | RHSA-2026:44066 |
| RHEL 8.8 TUS | jakarta-commons-httpclient | 1:3.1-28.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | javassist +1 | 3.18.1-8.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | pki-servlet-engine | 1:9.0.62-1.module+el8.8.0+22367+4894538d | RHSA-2026:44066 |
| RHEL 8.8 TUS | python-nss +2 | 1.0.1-10.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | relaxngDatatype | 2011.1-7.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | resteasy | 3.0.26-7.module+el8.8.0+22365+b433a336 | RHSA-2026:44066 |
| RHEL 8.8 TUS | slf4j +1 | 1.7.25-4.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | stax-ex | 1.7.7-8.module+el8.2.0+5723+4574fbff | RHSA-2026:44066 |
| RHEL 8.8 TUS | velocity | 1.7-24.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | xalan-j2 | 2.7.1-38.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | xerces-j2 | 2.11.0-34.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | xml-commons-apis | 1.4.01-25.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | xml-commons-resolver | 1.2-26.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 TUS | xmlstreambuffer | 1.5.4-8.module+el8.2.0+5723+4574fbff | RHSA-2026:44066 |
| RHEL 8.8 TUS | xsom | 0-19.20110809svn.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | apache-commons-collections | 3.2.2-10.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | apache-commons-lang | 2.6-21.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | apache-commons-net | 3.6-3.module+el8.3.0+6805+72837426 | RHSA-2026:44066 |
| RHEL 8.8 E4S | bea-stax +1 | 1.2.0-16.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | fasterxml-oss-parent | 75-1.module+el8.8.0+24520+bae56b06 | RHSA-2026:44066 |
| RHEL 8.8 E4S | glassfish-fastinfoset | 1.2.13-9.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | glassfish-jaxb +3 | 2.2.11-11.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | glassfish-jaxb-api | 2.2.12-8.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | jackson-bom +6 | 2.21.4-1.module+el8.8.0+24520+bae56b06 | RHSA-2026:44066 |
| RHEL 8.8 E4S | jackson-parent +1 | 2.21-1.module+el8.8.0+24520+bae56b06 | RHSA-2026:44066 |
| RHEL 8.8 E4S | jakarta-commons-httpclient | 1:3.1-28.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | javassist +1 | 3.18.1-8.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | pki-servlet-engine | 1:9.0.62-1.module+el8.8.0+22367+4894538d | RHSA-2026:44066 |
| RHEL 8.8 E4S | python-nss +2 | 1.0.1-10.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | relaxngDatatype | 2011.1-7.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | resteasy | 3.0.26-7.module+el8.8.0+22365+b433a336 | RHSA-2026:44066 |
| RHEL 8.8 E4S | slf4j +1 | 1.7.25-4.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | stax-ex | 1.7.7-8.module+el8.2.0+5723+4574fbff | RHSA-2026:44066 |
| RHEL 8.8 E4S | velocity | 1.7-24.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | xalan-j2 | 2.7.1-38.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | xerces-j2 | 2.11.0-34.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | xml-commons-apis | 1.4.01-25.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | xml-commons-resolver | 1.2-26.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.8 E4S | xmlstreambuffer | 1.5.4-8.module+el8.2.0+5723+4574fbff | RHSA-2026:44066 |
| RHEL 8.8 E4S | xsom | 0-19.20110809svn.module+el8.1.0+3366+6dfb954c | RHSA-2026:44066 |
| RHEL 8.6 EUS Long Life | apache-commons-collections | 3.2.2-10.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | apache-commons-lang | 2.6-21.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | apache-commons-net | 3.6-3.module+el8.3.0+6805+72837426 | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | bea-stax +1 | 1.2.0-16.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | fasterxml-oss-parent | 75-1.module+el8.6.0+24530+83fbd25a | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | glassfish-fastinfoset | 1.2.13-9.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | glassfish-jaxb +3 | 2.2.11-11.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | glassfish-jaxb-api | 2.2.12-8.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | jackson-bom +6 | 2.21.4-1.module+el8.6.0+24530+83fbd25a | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | jackson-parent +1 | 2.21-1.module+el8.6.0+24530+83fbd25a | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | jakarta-commons-httpclient | 1:3.1-28.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | javassist +1 | 3.18.1-8.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | pki-servlet-engine +1 | 1:9.0.30-3.module+el8.6.0+23938+b3b8726f.3 | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | python-nss +2 | 1.0.1-10.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | relaxngDatatype | 2011.1-7.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | resteasy | 3.0.26-6.module+el8.6.0+23400+aafc0b27 | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | slf4j +1 | 1.7.25-4.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | stax-ex | 1.7.7-8.module+el8.2.0+5723+4574fbff | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | velocity | 1.7-24.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | xalan-j2 | 2.7.1-38.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | xerces-j2 | 2.11.0-34.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | xml-commons-apis | 1.4.01-25.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | xml-commons-resolver | 1.2-26.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | xmlstreambuffer | 1.5.4-8.module+el8.2.0+5723+4574fbff | RHSA-2026:44061 |
| RHEL 8.6 EUS Long Life | xsom | 0-19.20110809svn.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | apache-commons-collections | 3.2.2-10.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | apache-commons-lang | 2.6-21.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | apache-commons-net | 3.6-3.module+el8.3.0+6805+72837426 | RHSA-2026:44061 |
| RHEL 8.6 AUS | bea-stax +1 | 1.2.0-16.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | fasterxml-oss-parent | 75-1.module+el8.6.0+24530+83fbd25a | RHSA-2026:44061 |
| RHEL 8.6 AUS | glassfish-fastinfoset | 1.2.13-9.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | glassfish-jaxb +3 | 2.2.11-11.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | glassfish-jaxb-api | 2.2.12-8.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | jackson-bom +6 | 2.21.4-1.module+el8.6.0+24530+83fbd25a | RHSA-2026:44061 |
| RHEL 8.6 AUS | jackson-parent +1 | 2.21-1.module+el8.6.0+24530+83fbd25a | RHSA-2026:44061 |
| RHEL 8.6 AUS | jakarta-commons-httpclient | 1:3.1-28.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | javassist +1 | 3.18.1-8.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | pki-servlet-engine +1 | 1:9.0.30-3.module+el8.6.0+23938+b3b8726f.3 | RHSA-2026:44061 |
| RHEL 8.6 AUS | python-nss +2 | 1.0.1-10.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | relaxngDatatype | 2011.1-7.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | resteasy | 3.0.26-6.module+el8.6.0+23400+aafc0b27 | RHSA-2026:44061 |
| RHEL 8.6 AUS | slf4j +1 | 1.7.25-4.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | stax-ex | 1.7.7-8.module+el8.2.0+5723+4574fbff | RHSA-2026:44061 |
| RHEL 8.6 AUS | velocity | 1.7-24.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | xalan-j2 | 2.7.1-38.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | xerces-j2 | 2.11.0-34.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | xml-commons-apis | 1.4.01-25.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | xml-commons-resolver | 1.2-26.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.6 AUS | xmlstreambuffer | 1.5.4-8.module+el8.2.0+5723+4574fbff | RHSA-2026:44061 |
| RHEL 8.6 AUS | xsom | 0-19.20110809svn.module+el8.1.0+3366+6dfb954c | RHSA-2026:44061 |
| RHEL 8.4 EUS Long Life | apache-commons-collections | 3.2.2-10.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | apache-commons-lang | 2.6-21.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | apache-commons-net | 3.6-3.module+el8.3.0+6805+72837426 | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | bea-stax +1 | 1.2.0-16.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | fasterxml-oss-parent | 75-1.module+el8.4.0+24531+dcbbef34 | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | glassfish-fastinfoset | 1.2.13-9.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | glassfish-jaxb +3 | 2.2.11-11.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | glassfish-jaxb-api | 2.2.12-8.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | jackson-bom +6 | 2.21.4-1.module+el8.4.0+24531+dcbbef34 | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | jackson-parent +1 | 2.21-1.module+el8.4.0+24531+dcbbef34 | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | jakarta-commons-httpclient | 1:3.1-28.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | javassist +1 | 3.18.1-8.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | pki-servlet-engine +1 | 1:9.0.30-1.module+el8.4.0+23942+fa6501e9.3 | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | python-nss +2 | 1.0.1-10.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | relaxngDatatype | 2011.1-7.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | resteasy | 3.0.26-6.module+el8.4.0+23399+fc91639f | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | slf4j +1 | 1.7.25-4.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | stax-ex | 1.7.7-8.module+el8.2.0+5723+4574fbff | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | velocity | 1.7-24.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | xalan-j2 | 2.7.1-38.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | xerces-j2 | 2.11.0-34.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | xml-commons-apis | 1.4.01-25.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | xml-commons-resolver | 1.2-26.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | xmlstreambuffer | 1.5.4-8.module+el8.2.0+5723+4574fbff | RHSA-2026:44062 |
| RHEL 8.4 EUS Long Life | xsom | 0-19.20110809svn.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | apache-commons-collections | 3.2.2-10.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | apache-commons-lang | 2.6-21.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | apache-commons-net | 3.6-3.module+el8.3.0+6805+72837426 | RHSA-2026:44062 |
| RHEL 8.4 AUS | bea-stax +1 | 1.2.0-16.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | fasterxml-oss-parent | 75-1.module+el8.4.0+24531+dcbbef34 | RHSA-2026:44062 |
| RHEL 8.4 AUS | glassfish-fastinfoset | 1.2.13-9.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | glassfish-jaxb +3 | 2.2.11-11.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | glassfish-jaxb-api | 2.2.12-8.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | jackson-bom +6 | 2.21.4-1.module+el8.4.0+24531+dcbbef34 | RHSA-2026:44062 |
| RHEL 8.4 AUS | jackson-parent +1 | 2.21-1.module+el8.4.0+24531+dcbbef34 | RHSA-2026:44062 |
| RHEL 8.4 AUS | jakarta-commons-httpclient | 1:3.1-28.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | javassist +1 | 3.18.1-8.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | pki-servlet-engine +1 | 1:9.0.30-1.module+el8.4.0+23942+fa6501e9.3 | RHSA-2026:44062 |
| RHEL 8.4 AUS | python-nss +2 | 1.0.1-10.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | relaxngDatatype | 2011.1-7.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | resteasy | 3.0.26-6.module+el8.4.0+23399+fc91639f | RHSA-2026:44062 |
| RHEL 8.4 AUS | slf4j +1 | 1.7.25-4.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | stax-ex | 1.7.7-8.module+el8.2.0+5723+4574fbff | RHSA-2026:44062 |
| RHEL 8.4 AUS | velocity | 1.7-24.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | xalan-j2 | 2.7.1-38.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | xerces-j2 | 2.11.0-34.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | xml-commons-apis | 1.4.01-25.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | xml-commons-resolver | 1.2-26.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| RHEL 8.4 AUS | xmlstreambuffer | 1.5.4-8.module+el8.2.0+5723+4574fbff | RHSA-2026:44062 |
| RHEL 8.4 AUS | xsom | 0-19.20110809svn.module+el8.1.0+3366+6dfb954c | RHSA-2026:44062 |
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.40.0-8.redhat_00024.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-apache-cxf +3 | 4.1.7-1.SP1_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-artemis-wildfly-integration | 2.0.5-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-bouncycastle +5 | 1.85.0-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-cryptacular | 1.2.7-1.redhat_00002.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 801.8.0-1.GA_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.6.54-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-httpcomponents-asyncclient | 4.1.5-5.redhat_00008.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-ironjacamar +8 | 3.0.22-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jackson-core +12 | 2.18.9-1.redhat_00003.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jakarta-xml-bind-api | 4.0.5-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jaxb +9 | 4.0.7-4.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jaxbintros | 2.1.0-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jboss-logging | 3.6.3-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jboss-remoting | 5.0.31-1.SP2_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jbossws-api | 3.1.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jbossws-common-tools | 2.2.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jbossws-cxf | 7.4.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jbossws-jaxws-undertow-httpspi | 3.0.1-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jbossws-spi | 5.1.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jsf-impl | 4.0.11-2.SP1_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-log4j | 2.25.4-1.redhat_00003.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-neethi | 3.2.2-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.136-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-nimbus-jose-jwt | 9.37.4-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-parsson | 1.1.9-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-saaj-impl +1 | 3.0.6-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-slf4j +1 | 2.0.18-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-undertow | 2.3.26-2.SP3_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.1.8-9.GA_redhat_00006.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-wildfly-elytron +1 | 2.6.11-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-wildfly-javadocs | 8.1.1-12.GA_redhat_00048.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-ws-commons-XmlSchema | 2.3.2-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat Certificate System 10 | jss +4 | 5.9.1-2.module+el8pki+24483+db4528cf | RHSA-2026:48095 |
| Red Hat Certificate System 10 | ldapjdk +2 | 5.6.0-3.module+el8pki+24228+5326976e | RHSA-2026:48095 |
| Red Hat Certificate System 10 | redhat-pki +16 | 11.9.2-4.module+el8pki+24565+7517ad63 | RHSA-2026:48095 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | idm-pki-ca +7 | 11.9.0-4.el10_2.alma.1 | ALSA-2026:43400 |
| AlmaLinux 9 | pki-jackson-annotations | 2.21-1.el9_8 | ALSA-2026:40895 |
| AlmaLinux 9 | pki-jackson-core +4 | 2.21.4-1.el9_8 | ALSA-2026:40895 |
| AlmaLinux 8 | apache-commons-collections | 3.2.2-10.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | apache-commons-lang | 2.6-21.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | apache-commons-net | 3.6-3.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | bea-stax-api | 1.2.0-16.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | glassfish-fastinfoset | 1.2.13-9.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | glassfish-jaxb-api | 2.2.12-8.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | glassfish-jaxb-core +2 | 2.2.11-12.module_el8.10.0+3791+e0637953 | ALSA-2026:43218 |
| AlmaLinux 8 | jackson-annotations | 2.21-1.module_el8.10.0+4235+0924958e | ALSA-2026:43218 |
| AlmaLinux 8 | jackson-core +3 | 2.21.4-1.module_el8.10.0+4235+0924958e | ALSA-2026:43218 |
| AlmaLinux 8 | jackson-module-jaxb-annotations | 2.21.4-2.module_el8.10.0+4235+0924958e | ALSA-2026:43218 |
| AlmaLinux 8 | jakarta-commons-httpclient | 1:3.1-28.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | javassist +1 | 3.18.1-8.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | pki-servlet-engine | 1:9.0.62-1.module_el8.10.0+3791+e0637953 | ALSA-2026:43218 |
| AlmaLinux 8 | relaxngDatatype | 2011.1-7.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | slf4j +1 | 1.7.25-4.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | stax-ex | 1.7.7-8.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | velocity | 1.7-24.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | xalan-j2 | 2.7.1-38.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | xerces-j2 | 2.11.0-34.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | xml-commons-apis | 1.4.01-25.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | xml-commons-resolver | 1.2-26.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | xmlstreambuffer | 1.5.4-8.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
| AlmaLinux 8 | xsom | 0-19.20110809svn.module_el8.5.0+2577+9e95fe00 | ALSA-2026:43218 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | dogtag-pki | 11.9.0-4.el10_2.rocky.0.1 | RLSA-2026:43400 |
| Rocky Linux 9 | jackson-annotations | 2.21-1.el9_8 | RLSA-2026:40895 |
| Rocky Linux 9 | jackson-core +3 | 2.21.4-1.el9_8 | RLSA-2026:40895 |
| Rocky Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.3.0+74+855e3f5d | RLSA-2026:43218 |
| Rocky Linux 8 | apache-commons-lang | 2.6-21.module+el8.3.0+74+855e3f5d | RLSA-2026:43218 |
| Rocky Linux 8 | apache-commons-net | 3.6-3.module+el8.3.0+74+855e3f5d | RLSA-2026:43218 |
| Rocky Linux 8 | bea-stax | 1.2.0-16.module+el8.10.0+1763+c7c02164 | RLSA-2026:43218 |
| Rocky Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.10.0+1763+c7c02164 | RLSA-2026:43218 |
| Rocky Linux 8 | glassfish-jaxb | 2.2.11-12.module+el8.10.0+1763+c7c02164 | RLSA-2026:43218 |
| Rocky Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.10.0+1763+c7c02164 | RLSA-2026:43218 |
| Rocky Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+74+855e3f5d | RLSA-2026:43218 |
| Rocky Linux 8 | javassist | 3.18.1-8.module+el8.3.0+74+855e3f5d | RLSA-2026:43218 |
| Rocky Linux 8 | pki-servlet-engine | 1:9.0.62-1.module+el8.10.0+1767+f923f786 | RLSA-2026:43218 |
| Rocky Linux 8 | relaxngDatatype | 2011.1-7.module+el8.10.0+1763+c7c02164 | RLSA-2026:43218 |
| Rocky Linux 8 | slf4j | 1.7.25-4.module+el8.3.0+74+855e3f5d | RLSA-2026:43218 |
| Rocky Linux 8 | stax-ex | 1.7.7-8.module+el8.10.0+1763+c7c02164 | RLSA-2026:43218 |
| Rocky Linux 8 | velocity | 1.7-24.module+el8.3.0+74+855e3f5d | RLSA-2026:43218 |
| Rocky Linux 8 | xalan-j2 | 2.7.1-38.module+el8.3.0+74+855e3f5d | RLSA-2026:43218 |
| Rocky Linux 8 | xerces-j2 | 2.11.0-34.module+el8.3.0+74+855e3f5d | RLSA-2026:43218 |
| Rocky Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.3.0+74+855e3f5d | RLSA-2026:43218 |
| Rocky Linux 8 | xml-commons-resolver | 1.2-26.module+el8.3.0+74+855e3f5d | RLSA-2026:43218 |
| Rocky Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.10.0+1763+c7c02164 | RLSA-2026:43218 |
| Rocky Linux 8 | xsom | 0-19.20110809svn.module+el8.10.0+1763+c7c02164 | RLSA-2026:43218 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | jackson-core +1 | 2.18.8-150200.3.22.3 | SUSE-SU-2026:2801-1 |
| SLES 15 SP7 | jackson-databind | 2.18.8-150200.3.28.2 | SUSE-SU-2026:2801-1 |
| SLES 15 SP7 | jackson-dataformats-binary | 2.18.8-150200.3.21.3 | SUSE-SU-2026:2801-1 |
| SLES 15 SP6 | jackson-core +1 | 2.18.8-150200.3.22.3 | SUSE-SU-2026:2801-1 |
| SLES 15 SP6 | jackson-databind | 2.18.8-150200.3.28.2 | SUSE-SU-2026:2801-1 |
| SLES 15 SP6 | jackson-dataformats-binary | 2.18.8-150200.3.21.3 | SUSE-SU-2026:2801-1 |
| SLES 15 SP5 | jackson-core +1 | 2.18.8-150200.3.22.3 | SUSE-SU-2026:2801-1 |
| SLES 15 SP5 | jackson-databind | 2.18.8-150200.3.28.2 | SUSE-SU-2026:2801-1 |
| SLES 15 SP5 | jackson-dataformats-binary | 2.18.8-150200.3.21.3 | SUSE-SU-2026:2801-1 |
| SLES 15 SP4 | jackson-core +1 | 2.18.8-150200.3.22.3 | SUSE-SU-2026:2801-1 |
| SLES 15 SP4 | jackson-databind | 2.18.8-150200.3.28.2 | SUSE-SU-2026:2801-1 |
| SLES 15 SP4 | jackson-dataformats-binary | 2.18.8-150200.3.21.3 | SUSE-SU-2026:2801-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | jackson-core +2 | 2.18.8-160000.1.1 | SUSE-SU-2026:22504-1 |
| SLES for SAP 15 SP6 | jackson-core +1 | 2.18.8-150200.3.22.3 | SUSE-SU-2026:2801-1 |
| SLES for SAP 15 SP6 | jackson-databind | 2.18.8-150200.3.28.2 | SUSE-SU-2026:2801-1 |
| SLES for SAP 15 SP6 | jackson-dataformats-binary | 2.18.8-150200.3.21.3 | SUSE-SU-2026:2801-1 |
| SLES for SAP 15 SP5 | jackson-core +1 | 2.18.8-150200.3.22.3 | SUSE-SU-2026:2801-1 |
| SLES for SAP 15 SP5 | jackson-databind | 2.18.8-150200.3.28.2 | SUSE-SU-2026:2801-1 |
| SLES for SAP 15 SP5 | jackson-dataformats-binary | 2.18.8-150200.3.21.3 | SUSE-SU-2026:2801-1 |
| SLES for SAP 15 SP4 | jackson-core +1 | 2.18.8-150200.3.22.3 | SUSE-SU-2026:2801-1 |
| SLES for SAP 15 SP4 | jackson-databind | 2.18.8-150200.3.28.2 | SUSE-SU-2026:2801-1 |
| SLES for SAP 15 SP4 | jackson-dataformats-binary | 2.18.8-150200.3.21.3 | SUSE-SU-2026:2801-1 |
| SLES 16.0 | jackson-core +2 | 2.18.8-160000.1.1 | SUSE-SU-2026:22504-1 |
| SLE HPC 15 SP5 | jackson-core +1 | 2.18.8-150200.3.22.3 | SUSE-SU-2026:2801-1 |
| SLE HPC 15 SP5 | jackson-databind | 2.18.8-150200.3.28.2 | SUSE-SU-2026:2801-1 |
| SLE HPC 15 SP5 | jackson-dataformats-binary | 2.18.8-150200.3.21.3 | SUSE-SU-2026:2801-1 |
| SLE HPC 15 SP4 | jackson-core +1 | 2.18.8-150200.3.22.3 | SUSE-SU-2026:2801-1 |
| SLE HPC 15 SP4 | jackson-databind | 2.18.8-150200.3.28.2 | SUSE-SU-2026:2801-1 |
| SLE HPC 15 SP4 | jackson-dataformats-binary | 2.18.8-150200.3.21.3 | SUSE-SU-2026:2801-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | jackson-databind | 2.18.8-1.1 | openSUSE-SU-2026:11118-1 |
| openSUSE Leap 16.0 | jackson-core +2 | 2.18.8-160000.1.1 | openSUSE-SU-2026:21201-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | jackson-databind | 2.16.1-4.amzn2023.0.2 | ALAS2023-2026-1947 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | idm-pki-ca +7 | 11.9.0-4.0.1.el10_2 | ELSA-2026-43400 |
| Oracle Linux 9 | pki-jackson-annotations | 2.21-1.el9_8 | ELSA-2026-40895 |
| Oracle Linux 9 | pki-jackson-core +4 | 2.21.4-1.el9_8 | ELSA-2026-40895 |
| Oracle Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.10.0+90642+1ede0e5a | ELSA-2026-43218 |
| Oracle Linux 8 | apache-commons-lang | 2.6-21.module+el8.10.0+90682+879b1f6e | ELSA-2026-43218 |
| Oracle Linux 8 | apache-commons-net | 3.6-3.module+el8.10.0+90642+1ede0e5a | ELSA-2026-43218 |
| Oracle Linux 8 | bea-stax-api | 1.2.0-16.module+el8.10.0+90682+879b1f6e | ELSA-2026-43218 |
| Oracle Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.10.0+90682+879b1f6e | ELSA-2026-43218 |
| Oracle Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.10.0+90682+879b1f6e | ELSA-2026-43218 |
| Oracle Linux 8 | glassfish-jaxb-core +2 | 2.2.11-12.module+el8.10.0+90642+1ede0e5a | ELSA-2026-43218 |
| Oracle Linux 8 | jackson-annotations | 2.21-1.module+el8.10.0+90972+fe199724 | ELSA-2026-43218 |
| Oracle Linux 8 | jackson-core +3 | 2.21.4-1.module+el8.10.0+90972+fe199724 | ELSA-2026-43218 |
| Oracle Linux 8 | jackson-module-jaxb-annotations | 2.21.4-2.module+el8.10.0+90972+fe199724 | ELSA-2026-43218 |
| Oracle Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.10.0+90682+879b1f6e | ELSA-2026-43218 |
| Oracle Linux 8 | javassist +1 | 3.18.1-8.module+el8.10.0+90682+879b1f6e | ELSA-2026-43218 |
| Oracle Linux 8 | pki-servlet-engine | 1:9.0.62-1.module+el8.10.0+90642+1ede0e5a | ELSA-2026-43218 |
| Oracle Linux 8 | relaxngDatatype | 2011.1-7.module+el8.10.0+90682+879b1f6e | ELSA-2026-43218 |
| Oracle Linux 8 | slf4j +1 | 1.7.25-4.module+el8.10.0+90682+879b1f6e | ELSA-2026-43218 |
| Oracle Linux 8 | stax-ex | 1.7.7-8.module+el8.10.0+90682+879b1f6e | ELSA-2026-43218 |
| Oracle Linux 8 | velocity | 1.7-24.module+el8.10.0+90642+1ede0e5a | ELSA-2026-43218 |
| Oracle Linux 8 | xalan-j2 | 2.7.1-38.module+el8.10.0+90682+879b1f6e | ELSA-2026-43218 |
| Oracle Linux 8 | xerces-j2 | 2.11.0-34.module+el8.10.0+90642+1ede0e5a | ELSA-2026-43218 |
| Oracle Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.10.0+90682+879b1f6e | ELSA-2026-43218 |
| Oracle Linux 8 | xml-commons-resolver | 1.2-26.module+el8.10.0+90642+1ede0e5a | ELSA-2026-43218 |
| Oracle Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.10.0+90682+879b1f6e | ELSA-2026-43218 |
| Oracle Linux 8 | xsom | 0-19.20110809svn.module+el8.10.0+90642+1ede0e5a | ELSA-2026-43218 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.3.0-r3 | — |
| Wolfi rolling | akhq | 0.27.1-r5 | — |
| Wolfi rolling | apache-nifi +5 | No fix yet | — |
| Wolfi rolling | apache-pulsar-4.2 | 4.2.3-r1 | — |
| Wolfi rolling | apache-tika-3.1 | 3.1.0-r33 | — |
| Wolfi rolling | apache-tika-3.2 | 3.2.3-r13 | — |
| Wolfi rolling | apache-tika-3.2-compat | 3.2.3-r18 | — |
| Wolfi rolling | apache-tika-3.3 | 3.3.1-r5 | — |
| Wolfi rolling | apicurio-registry | 3.3.0-r6 | — |
| Wolfi rolling | cassandra-4.1 | 4.1.11-r1 | — |
| Wolfi rolling | cassandra-5.0 | 5.0.8-r7 | — |
| Wolfi rolling | cassandra-reaper | 4.2.5-r3 | — |
| Wolfi rolling | celeborn-0.6 | 0.6.3-r9 | — |
| Wolfi rolling | confluent-common-docker | 7.6.9-r6 | — |
| Wolfi rolling | confluent-kafka | 8.4.0.253-r2 | — |
| Wolfi rolling | dependency-track +1 | 4.14.2-r3 | — |
| Wolfi rolling | druid | 37.0.0-r14 | — |
| Wolfi rolling | flyway | 12.9.0-r1 | — |
| Wolfi rolling | gradle-8 | 8.14.5-r1 | — |
| Wolfi rolling | gradle-9 | 9.6.1-r1 | — |
| Wolfi rolling | infinispan-16.1 | 16.1.4-r5 | — |
| Wolfi rolling | jenkins-2-openjdk-21 +1 | 2.572-r0 | — |
| Wolfi rolling | jenkins-plugin-manager | 2.15.0-r4 | — |
| Wolfi rolling | kafka-4.1 | 4.1.2-r3 | — |
| Wolfi rolling | kafka-4.2 | 4.2.1-r3 | — |
| Wolfi rolling | keycloak-26.5 +2 | 26.5.7-r8 | — |
| Wolfi rolling | keycloak-26.6 +2 | 26.6.4-r1 | — |
| Wolfi rolling | keycloak-config-cli +1 | 6.5.1-r5 | — |
| Wolfi rolling | kserve-modelmesh | 0.12.0-r36 | — |
| Wolfi rolling | logstash-9.3 +1 | 9.3.8-r0 | — |
| Wolfi rolling | logstash-9.4 +1 | 9.4.2-r7 | — |
| Wolfi rolling | management-api-for-apache-cassandra-5.0 | 0.1.122-r1 | — |
| Wolfi rolling | neo4j-2026.05 | 2026.05.0-r4 | — |
| Wolfi rolling | nextflow | 26.04.4-r1 | — |
| Wolfi rolling | opensearch-2 | 2.19.6-r0 | — |
| Wolfi rolling | opensearch-3 +14 | 3.7.0-r2 | — |
| Wolfi rolling | opensearch-3-iamguarded-compat | 3.8.0-r3 | — |
| Wolfi rolling | ruby3.2-jrjackson +2 | 0.5.2-r0 | — |
| Wolfi rolling | ruby4.0-jrjackson | 0.5.0-r1 | — |
| Wolfi rolling | scala-3.8 | 3.8.4-r4 | — |
| Wolfi rolling | solr-10 +1 | 10.0.0-r6 | — |
| Wolfi rolling | sonarqube | 26.8.0.126808-r0 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.3-r2 | — |
| Wolfi rolling | spark-4.1-scala-2.13 | 4.1.2-r5 | — |
| Wolfi rolling | spdx-tools-java | 2.0.6-r5 | — |
| Wolfi rolling | strimzi-kafka-operator-kafka-init +8 | 1.0.1-r2 | — |
| Wolfi rolling | tez | 0.10.5-r17 | — |
| Wolfi rolling | thingsboard-tb-node +1 | 4.3.1.2-r12 | — |
| Wolfi rolling | trino +53 | 482-r0 | — |
| Wolfi rolling | trino-plugin-teradata-functions | 483-r7 | — |
| Wolfi rolling | wavefront-proxy | 13.9-r21 | — |
| Wolfi rolling | zipkin +1 | 3.6.1-r15 | — |
| Wolfi rolling | zookeeper-3.9 | 3.9.5-r8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.10.0, < 2.18.8 | 2.18.8 | GHSA-rmj7-2vxq-3g9f |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.19.0, < 2.21.4 | 2.21.4 | GHSA-rmj7-2vxq-3g9f |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 3.0.0, < 3.1.4 | 3.1.4 | GHSA-rmj7-2vxq-3g9f |
| Maven | tools.jackson.core:jackson-databind | >= 3.0.0, < 3.1.4 | 3.1.4 | GHSA-rmj7-2vxq-3g9f |
Advisories 40
- WID-SEC-2026-2058 FasterXML Jackson: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-4056 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-3376 Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- WID-SEC-2026-3595 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- WID-SEC-2026-2867 RealObjects PDFreactor: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 29, 2026
- ALSA-2026:40895 Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:43400 Important: dogtag-pki security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:43218 Important: pki-deps:10.6 security update AlmaLinux Security Advisories · Oct 29, 2026
- NCSC-2026-0448 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Oct 22, 2026
- WID-SEC-2026-4084 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
- WID-SEC-2026-4078 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
- RHSA-2026:70230 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:70229 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:70228 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:48095 Red Hat Security Advisory: RHCS 10.8 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:44271 Red Hat Security Advisory: dogtag-pki security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:44065 Red Hat Security Advisory: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:44066 Red Hat Security Advisory: pki-deps:10.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:44063 Red Hat Security Advisory: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:44064 Red Hat Security Advisory: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:44062 Red Hat Security Advisory: pki-deps:10.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:44061 Red Hat Security Advisory: pki-deps:10.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:43400 Red Hat Security Advisory: dogtag-pki security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:43218 Red Hat Security Advisory: pki-deps:10.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:40895 Red Hat Security Advisory: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-3043 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- WID-SEC-2026-3401 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 15, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026
- RLSA-2026:43400 Important: dogtag-pki security update Rocky Linux Security Advisories · Jul 23, 2026
- ELSA-2026-43218 Important: pki-deps:10.6 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 23, 2026
- ELSA-2026-43400 Important: dogtag-pki security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 23, 2026
- RLSA-2026:43218 Important: pki-deps:10.6 security update Rocky Linux Security Advisories · Jul 22, 2026
- ALAS2023-2026-1947 Important: jackson-databind security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2026
- ELSA-2026-40895 Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 20, 2026
- RLSA-2026:40895 Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update Rocky Linux Security Advisories · Jul 17, 2026
- SUSE-SU-2026:2801-1 Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent SUSE / openSUSE Security Updates · Jul 9, 2026
- SUSE-SU-2026:22504-1 Security update for jackson-annotations, jackson-core, jackson-databind SUSE / openSUSE Security Updates · Jul 7, 2026
- openSUSE-SU-2026:21201-1 Security update for jackson-annotations, jackson-core, jackson-databind SUSE / openSUSE Security Updates · Jul 3, 2026
- openSUSE-SU-2026:11118-1 jackson-databind-2.18.8-1.1 on GA media SUSE / openSUSE Security Updates · Jun 26, 2026
References
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f
- https://github.com/FasterXML/jackson-databind/issues/5981
- https://github.com/FasterXML/jackson-databind/issues/5983
- https://github.com/FasterXML/jackson-databind/pull/5984
- https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5
- https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e