Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2026-54515 EUVD-2026-38591GHSA-5jmj-h7xm-6q6v

jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

Published Jun 23, 2026 · Updated Jun 24, 2026 · Assigned by GitHub_M

Vendor: FasterXML Product: jackson-databind Package: airflow-3 Package: akhq Package: apache-nifi Package: apache-nifi-registry Package: apache-nifi-registry-toolkit Package: apache-nifi-toolkit Package: apache-pulsar-4.2 Package: apache-tika-3.1 Package: apache-tika-3.2 Package: apache-tika-3.2-compat Package: apache-tika-3.3 Package: apicurio-registry Package: cassandra-4.1 Package: cassandra-5.0 Package: cassandra-reaper Package: celeborn-0.6 Package: com.fasterxml.jackson.core:jackson-databind Package: confluent-common-docker Package: confluent-kafka Package: dependency-track Package: dependency-track-bundled Package: druid Package: flyway Package: gradle-8 Package: gradle-9 Package: gradle-stage0 Package: infinispan-16.1 Package: infinispan-16.2 Package: jackson-databind Package: jackson-databind Package: jenkins-2-openjdk-21 Package: jenkins-2-openjdk-25 Package: jenkins-plugin-manager Package: kafka-4.1 Package: kafka-4.2 Package: keycloak-26.4-iamguarded-compat Package: keycloak-26.5 Package: keycloak-26.5-iamguarded-compat Package: keycloak-26.5-operator Package: keycloak-26.6 Package: keycloak-26.6-iamguarded-compat Package: keycloak-26.6-operator Package: keycloak-config-cli Package: keycloak-config-cli-iamguarded-compat Package: kserve-modelmesh Package: logstash-9.3 Package: logstash-9.3-iamguarded-compat Package: logstash-9.4 Package: logstash-9.4-iamguarded-compat Package: management-api-for-apache-cassandra-5.0 Package: neo4j-2026.01 Package: neo4j-2026.05 Package: neo4j-2026.05-docker-publish Package: neo4j-2026.06 Package: neo4j-2026.07 Package: nextflow Package: opensearch-2 Package: opensearch-3 Package: opensearch-3-alerting Package: opensearch-3-anomaly-detection Package: opensearch-3-crypto-kms Package: opensearch-3-discovery-ec2 Package: opensearch-3-iamguarded-compat Package: opensearch-3-ml-commons Package: opensearch-3-neural-search Package: opensearch-3-notifications Package: opensearch-3-observability Package: opensearch-3-performance-analyzer Package: opensearch-3-reporting Package: opensearch-3-repository-azure Package: opensearch-3-repository-s3 Package: opensearch-3-security Package: opensearch-3-sql Package: ruby3.2-jrjackson Package: ruby3.3-jrjackson Package: ruby3.4-jrjackson Package: ruby4.0-jrjackson Package: scala-3.8 Package: solr-10 Package: solr-10-iamguarded-compat Package: sonarqube Package: spark-4.0-scala-2.13 Package: spark-4.1-scala-2.13 Package: spdx-tools-java Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: strimzi-kafka-operator-v1-api-conversion Package: tez Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: tools.jackson.core:jackson-databind Package: trino Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: wavefront-proxy Package: wildfly-openjdk-17 Package: wildfly-openjdk-21 Package: zipkin Package: zipkin-slim Package: zookeeper-3.9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

Affected products

VendorProductAffectedFixed
FasterXML jackson-databind >= 2.8.0, < 2.18.9, >= 2.19.0, < 2.21.5, >= 3.1.0, < 3.1.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 jackson-databind 2.18.11-1 —
Debian 13 jackson-databind No fix yet —
Debian 12 jackson-databind No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 jackson-databind No fix yet —
Ubuntu 26.04 LTS jackson-databind No fix yet —
Ubuntu 25.10 jackson-databind No fix yet —
Ubuntu 24.04 LTS jackson-databind No fix yet —
Ubuntu 22.04 LTS jackson-databind No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS jackson-databind No fix yet —
Ubuntu 18.04 LTS jackson-databind No fix yet —
Ubuntu Pro 16.04 LTS jackson-databind No fix yet —
Ubuntu Pro 14.04 LTS jackson-databind No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Els 7 eap7-activemq-artemis +15 2.16.0-23.redhat_00058.1.el7eap RHSA-2026:67604
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jackson-core +10 2.18.9-1.redhat_00003.1.el7eap RHSA-2026:67604
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly +3 7.4.25-6.GA_redhat_00005.1.el7eap RHSA-2026:67604
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly-java-jdk17 7.4.25-6.GA_redhat_00005.1.el8eap RHSA-2026:67604
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.40.0-8.redhat_00024.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.1.7-1.SP1_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-artemis-wildfly-integration 2.0.5-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-bouncycastle +5 1.85.0-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-cryptacular 1.2.7-1.redhat_00002.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 801.8.0-1.GA_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-hibernate +2 6.6.54-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-httpcomponents-asyncclient 4.1.5-5.redhat_00008.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-ironjacamar +8 3.0.22-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jackson-core +12 2.18.9-1.redhat_00003.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jakarta-xml-bind-api 4.0.5-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jaxb +9 4.0.7-4.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jaxbintros 2.1.0-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jboss-logging 3.6.3-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jboss-remoting 5.0.31-1.SP2_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-api 3.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-common-tools 2.2.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-cxf 7.4.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-jaxws-undertow-httpspi 3.0.1-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-spi 5.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jsf-impl 4.0.11-2.SP1_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-log4j 2.25.4-1.redhat_00003.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-neethi 3.2.2-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-netty +14 4.1.136-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-nimbus-jose-jwt 9.37.4-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-parsson 1.1.9-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-saaj-impl +1 3.0.6-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.18-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-undertow 2.3.26-2.SP3_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly +3 8.1.8-9.GA_redhat_00006.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly-elytron +1 2.6.11-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly-javadocs 8.1.1-12.GA_redhat_00048.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-ws-commons-XmlSchema 2.3.2-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:3273-1, SUSE-SU-2026:2801-1
SLES 15 SP7 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:3273-1, SUSE-SU-2026:2801-1
SLES 15 SP7 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:3273-1, SUSE-SU-2026:2801-1
SLES 15 SP6 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES 15 SP6 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES 15 SP6 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLES 15 SP5 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES 15 SP5 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES 15 SP5 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLES 15 SP4 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES 15 SP4 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES 15 SP4 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 jackson-core +2 2.18.8-160000.1.1 SUSE-SU-2026:22822-1, SUSE-SU-2026:22504-1
SLES for SAP 15 SP6 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES for SAP 15 SP6 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES for SAP 15 SP6 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLES for SAP 15 SP5 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES for SAP 15 SP5 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES for SAP 15 SP5 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLES for SAP 15 SP4 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLES for SAP 15 SP4 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLES for SAP 15 SP4 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLES 16.0 jackson-core +2 2.18.8-160000.1.1 SUSE-SU-2026:22822-1, SUSE-SU-2026:22504-1
SLE HPC 15 SP5 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLE HPC 15 SP5 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLE HPC 15 SP5 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1
SLE HPC 15 SP4 jackson-core +1 2.18.8-150200.3.22.3 SUSE-SU-2026:2801-1
SLE HPC 15 SP4 jackson-databind 2.18.8-150200.3.28.2 SUSE-SU-2026:2801-1
SLE HPC 15 SP4 jackson-dataformats-binary 2.18.8-150200.3.21.3 SUSE-SU-2026:2801-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed jackson-databind 2.18.8-1.1 openSUSE-SU-2026:11118-1
openSUSE Leap 16.0 jackson-core +2 2.18.8-160000.1.1 openSUSE-SU-2026:21375-1, openSUSE-SU-2026:21201-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 jackson-databind 2.16.1-4.amzn2023.0.2 ALAS2023-2026-1947

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling airflow-3 3.3.0-r3 —
Wolfi rolling akhq 0.27.1-r14 —
Wolfi rolling apache-nifi +1 2.10.0-r3 —
Wolfi rolling apache-nifi-registry +1 2.10.0-r2 —
Wolfi rolling apache-pulsar-4.2 4.2.3-r2 —
Wolfi rolling apache-tika-3.1 3.1.0-r35 —
Wolfi rolling apache-tika-3.2 3.2.3-r15 —
Wolfi rolling apache-tika-3.2-compat 3.2.3-r18 —
Wolfi rolling apache-tika-3.3 3.3.1-r6 —
Wolfi rolling apicurio-registry 3.3.0-r9 —
Wolfi rolling cassandra-4.1 4.1.11-r3 —
Wolfi rolling cassandra-5.0 5.0.8-r10 —
Wolfi rolling cassandra-reaper 4.2.5-r5 —
Wolfi rolling celeborn-0.6 0.6.3-r9 —
Wolfi rolling confluent-common-docker 7.6.9-r6 —
Wolfi rolling confluent-kafka 8.4.0.406-r0 —
Wolfi rolling dependency-track +1 4.14.2-r5 —
Wolfi rolling druid 37.0.0-r14 —
Wolfi rolling flyway 12.9.0-r1 —
Wolfi rolling gradle-8 8.14.5-r2 —
Wolfi rolling gradle-9 9.6.1-r3 —
Wolfi rolling gradle-stage0 +4 No fix yet —
Wolfi rolling infinispan-16.1 16.1.4-r8 —
Wolfi rolling infinispan-16.2 16.2.1-r3 —
Wolfi rolling jenkins-2-openjdk-21 +1 2.574-r0 —
Wolfi rolling jenkins-plugin-manager 2.15.0-r5 —
Wolfi rolling kafka-4.1 4.1.2-r4 —
Wolfi rolling kafka-4.2 4.2.1-r4 —
Wolfi rolling keycloak-26.5 +2 26.5.7-r8 —
Wolfi rolling keycloak-26.6 +2 26.6.4-r16 —
Wolfi rolling keycloak-config-cli +1 6.5.1-r10 —
Wolfi rolling kserve-modelmesh 0.12.0-r37 —
Wolfi rolling logstash-9.3 +1 9.3.8-r2 —
Wolfi rolling logstash-9.4 +1 9.4.3-r3 —
Wolfi rolling management-api-for-apache-cassandra-5.0 0.1.122-r1 —
Wolfi rolling neo4j-2026.05 2026.05.0-r4 —
Wolfi rolling neo4j-2026.05-docker-publish 2026.05.0-r12 —
Wolfi rolling neo4j-2026.06 2026.06.0-r1 —
Wolfi rolling nextflow 26.04.4-r3 —
Wolfi rolling opensearch-2 2.19.6-r2 —
Wolfi rolling opensearch-3 +14 3.7.0-r2 —
Wolfi rolling opensearch-3-iamguarded-compat 3.8.0-r3 —
Wolfi rolling ruby3.2-jrjackson +3 0.5.2-r1 —
Wolfi rolling scala-3.8 3.8.4-r4 —
Wolfi rolling solr-10 +1 10.0.0-r7 —
Wolfi rolling sonarqube 26.8.0.126808-r0 —
Wolfi rolling spark-4.0-scala-2.13 4.0.4-r1 —
Wolfi rolling spark-4.1-scala-2.13 4.1.3-r2 —
Wolfi rolling spdx-tools-java 2.0.7-r2 —
Wolfi rolling strimzi-kafka-operator-kafka-init +6 1.1.0-r2 —
Wolfi rolling strimzi-kafka-operator-kafka-thirdparty-libs 1.0.1-r2 —
Wolfi rolling tez 0.10.5-r26 —
Wolfi rolling thingsboard-tb-node +1 4.3.1.2-r12 —
Wolfi rolling trino +53 482-r0 —
Wolfi rolling trino-plugin-teradata-functions 483-r7 —
Wolfi rolling wavefront-proxy 13.9-r23 —
Wolfi rolling wildfly-openjdk-17 +1 40.0.1-r4 —
Wolfi rolling zipkin +1 3.6.1-r16 —
Wolfi rolling zookeeper-3.9 3.9.5-r11 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • xiaoqiMikko/jackson-check ★ 0 · Aug 7, 2026

    jackson-databind + jackson-core 26 条安全公告自查:按坐标逐条求交集给出真正到位的版本(2.18.11/2.21.7/2.22.3/3.1.7/3.2.3,2.21.6 已不够);扫源码降噪告诉你真中几条;含 1 条 GitHub 全局库未收录、Dependabot 不报的(jackson-core 那条,升了 databind 也照样中) CVE-2026-5…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.fasterxml.jackson.core:jackson-databind >= 3.1.0, < 3.1.4 3.1.4 GHSA-5jmj-h7xm-6q6v
Maven com.fasterxml.jackson.core:jackson-databind >= 2.8.0, < 2.18.9 2.18.9 GHSA-5jmj-h7xm-6q6v
Maven com.fasterxml.jackson.core:jackson-databind >= 2.19.0, < 2.21.5 2.21.5 GHSA-5jmj-h7xm-6q6v
Maven com.fasterxml.jackson.core:jackson-databind >= 2.22.0, < 2.22.1 2.22.1 GHSA-5jmj-h7xm-6q6v
Maven tools.jackson.core:jackson-databind >= 3.1.0, < 3.1.4 3.1.4 GHSA-5jmj-h7xm-6q6v

Advisories 21

References