Red Hat Security AdvisoryRHSA-2026:93444
jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
Released 2026-11-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.9.4) jackson-annotations-2.21-1.el9_4.1, jackson-core-2.21.6-1.el9_4, jackson-databind-2.21.6-1.el9_4.1 +8
Fixes 2 records
Priority HIGH 72
Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00487 · Published 2026-09-23 · Partial fix · 2.21.7, 3.1.7 +3 CWE-400
Priority HIGH 72
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(v…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00628 · Published 2026-09-11 · Partial fix · 2.18.10, 2.21.6 +3 CWE-1333
