Red Hat Security Advisory

RHSA-2026:40895

jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

Released 2026-07-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) jackson-databind-2.21.4-1.el9_8, pki-jackson-databind-2.21.4-1.el9_8

TI-2026-39358 CVE-2026-54512 · GHSA-j3rv-43j4-c7qm

HIGH 70

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01066 Published 2026-06-23 Partial fix · 2.18.8, 2.21.4 +1 CWE-184

TI-2026-39359 CVE-2026-54513 · GHSA-rmj7-2vxq-3g9f

MEDIUM 40

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01226 Published 2026-06-23 Partial fix · 2.18.8, 2.21.4 +1 CWE-184