Read the docs
TI-2026-48272 Aliases CVE-2026-68497GHSA-q4xh-88c3-wmh7

Regular expression denial of service in FasterXML jackson-databind

Priority HIGH 72CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 32 fixed, 27 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00628 50th percentileScored 2026-11-07
Fix Partial jackson-databind (FasterXML): 2.18.10, 2.21.6, 2.22.2 +2tools.jackson.core:jackson-databind (Maven): 3.2.2, 3.1.6+1 more productRed Hat: 31 advisoriesRed Hat: 32 fixed, 27 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FasterXMLjackson-databind2.0.0 to before 2.18.10; 2.19.0 to before 2.21.6; 2.22.0 to before 2.22.22.18.10, 2.21.6, 2.22.2Patch availableCNA
FasterXMLjackson-databind3.0.0 to before 3.1.6; 3.2.0 to before 3.2.23.1.6, 3.2.2Patch availableCNA
—tools.jackson.core:jackson-databind (Maven)3.2.0 to before 3.2.23.2.2Patch availableGHSA-q4xh-88c3-wmh7
—tools.jackson.core:jackson-databind (Maven)3.0.0 to before 3.1.63.1.6Patch availableGHSA-q4xh-88c3-wmh7
—com.fasterxml.jackson.core:jackson-databind (Maven)2.14.0 to before 2.18.102.18.10Patch availableGHSA-q4xh-88c3-wmh7
—com.fasterxml.jackson.core:jackson-databind (Maven)2.19.0 to before 2.21.62.21.6Patch availableGHSA-q4xh-88c3-wmh7
—com.fasterxml.jackson.core:jackson-databind (Maven)2.22.0 to before 2.22.22.22.2Patch availableGHSA-q4xh-88c3-wmh7
  • jackson-databind VendorFasterXML Affected 2.0.0 to before 2.18.10; 2.19.0 to before 2.21.6; 2.22.0 to before 2.22.2 Fixed in 2.18.10, 2.21.6, 2.22.2 Patch available CNA
  • jackson-databind VendorFasterXML Affected 3.0.0 to before 3.1.6; 3.2.0 to before 3.2.2 Fixed in 3.1.6, 3.2.2 Patch available CNA
  • tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.2.0 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-q4xh-88c3-wmh7
  • tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.0.0 to before 3.1.6 Fixed in 3.1.6 Patch available GHSA-q4xh-88c3-wmh7
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.14.0 to before 2.18.10 Fixed in 2.18.10 Patch available GHSA-q4xh-88c3-wmh7
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.19.0 to before 2.21.6 Fixed in 2.21.6 Patch available GHSA-q4xh-88c3-wmh7
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.22.0 to before 2.22.2 Fixed in 2.22.2 Patch available GHSA-q4xh-88c3-wmh7

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*——FasterXML
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions — — ·FasterXML

Remediation

  • Fix · CNA jackson-databind (FasterXML) Fixed in 2.18.10, 2.21.6, 2.22.2
  • Fix · CNA jackson-databind (FasterXML) Fixed in 3.1.6, 3.2.2
  • Fix · GHSA-q4xh-88c3-wmh7 tools.jackson.core:jackson-databind (Maven) Fixed in 3.2.2 Advisory →
  • Fix · GHSA-q4xh-88c3-wmh7 tools.jackson.core:jackson-databind (Maven) Fixed in 3.1.6 Advisory →
  • Fix · GHSA-q4xh-88c3-wmh7 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.18.10 Advisory →
  • Fix · GHSA-q4xh-88c3-wmh7 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.21.6 Advisory →
  • Fix · GHSA-q4xh-88c3-wmh7 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.22.2 Advisory →

Red Hat 31 advisories

  • RHSA-2026:95221 Released 2026-11-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 XP 6.0.7.GA release
    • Red Hat JBoss Enterprise Application Platform 8.1
  • RHSA-2026:93444 Released 2026-11-02 · Red Hat rating Important
    jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) jackson-annotations-2.21-1.el9_4.1, jackson-core-2.21.6-1.el9_4, jackson-databind-2.21.6-1.el9_4.1 +8
  • RHSA-2026:92859 Released 2026-10-29 · Red Hat rating Important
    Satellite 6.17 security update
    • Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
Show 28 more Red Hat advisories
  • RHSA-2026:92861 Released 2026-10-29 · Red Hat rating Critical
    Satellite 6.19 security update
    • Red Hat Satellite 6.19 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, python3.12-brotli-1.2.1-1.el9pc +6
  • RHSA-2026:92858 Released 2026-10-29 · Red Hat rating Important
    Satellite 6.16 EUS security update
    • Red Hat Satellite 6.16 for RHEL 8 openvox-agent-8.31.1-1.el8sat, openvox-server-8.17.0-1.el8sat, yggdrasil-worker-forwarder-0.1.1-1.el8sat
    • Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
  • RHSA-2026:92860 Released 2026-10-29 · Red Hat rating Important
    Satellite 6.18 security update
    • Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:89924 Released 2026-10-26 · Red Hat rating Important
    jackson-databind security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) jackson-databind-2.21.6-1.el9_2.1, pki-jackson-databind-2.21.6-1.el9_2.1
  • RHSA-2026:89734 Released 2026-10-26 · Red Hat rating Important
    jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) jackson-core-2.21.6-1.el9_6, jackson-databind-2.21.6-1.el9_6.1, jackson-jaxrs-providers-2.21.6-1.el9_6 +6
  • RHSA-2026:88159 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88158 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88157 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88156 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88155 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88154 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88153 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88151 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88152 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88149 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88150 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
  • RHSA-2026:86621 Released 2026-10-21 · Red Hat rating Important
    dogtag-pki security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) dogtag-pki-11.6.0-3.el10_0.1, idm-pki-acme-11.6.0-3.el10_0.1, idm-pki-base-11.6.0-3.el10_0.1 +6
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83670 Released 2026-10-15 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.GA)
    • Red Hat Build of Apache Camel 3.33.4.redhat com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar, io.micrometer.micrometer-core-1.16.7.redhat-00002.jar +14
  • RHSA-2026:83520 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.4 release and security update
    • Red Hat build of Quarkus 3.33.4.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +10
  • RHSA-2026:83082 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.6 release and security update
    • Red Hat build of Quarkus 3.27.6.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +11
  • RHSA-2026:80504 Released 2026-10-12 · Red Hat rating Important
    jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream (v. 9) jackson-core-2.21.6-1.el9_8, jackson-databind-2.21.6-1.el9_8, jackson-jaxrs-providers-2.21.6-1.el9_8 +6
  • RHSA-2026:77648 Released 2026-10-08 · Red Hat rating Important
    dogtag-pki security update
    • Red Hat Enterprise Linux AppStream (v. 10) dogtag-pki-11.9.0-6.el10_2, idm-pki-acme-11.9.0-6.el10_2, idm-pki-base-11.9.0-6.el10_2 +6
  • RHSA-2026:73521 Released 2026-09-29 · Red Hat rating Important
    Red Hat Lightspeed (formerly Insights) for Runtimes security update
    • Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9
  • RHSA-2026:71675 Released 2026-09-24 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Certificate System 10AffectedNo fix yet
Red Hat Certificate System 11AffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat JBoss Web Server 7AffectedNo fix yet
Red Hat Offline Knowledge PortalAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix yet
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:88152
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:88149
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:88151
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:88150
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:88156
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:88159
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:88153
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:88158
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:88157
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:88155
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:88154
Red Hat Build of Apache Camel 3.33.4.redhatFixed RHSA-2026:83670
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:77648
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:80504
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:89924
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:93444
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:86621
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:89734
Red Hat JBoss Enterprise Application Platform 8.1Fixed RHSA-2026:95221
Red Hat Lightspeed (formerly Insights) for Runtimes 1.0Fixed RHSA-2026:73521
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:92858
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:92858
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:92859
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:92860
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:92861
Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16Fixed RHSA-2026:71675
Red Hat build of Quarkus 3.27.6.redhatFixed RHSA-2026:83082
Red Hat build of Quarkus 3.33.4.redhatFixed RHSA-2026:83520
Not affected: 31 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Apache Camel 3.33.4.redhat
  • Red Hat Build of Keycloak
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat Satellite 6
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9
  • Red Hat build of Quarkus 3.27.6.redhat
  • Red Hat build of Quarkus 3.33.4.redhat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-68497
  2. 2026-10-03 Alias added: GHSA-q4xh-88c3-wmh7
  3. 2026-10-07 Affected versions changed · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:77648 · Red Hat
  5. 2026-10-09 Fix available: Red Hat Enterprise Linux AppStream (v. 10) · Red Hat
  6. 2026-10-12 Fix available: RHSA-2026:80504 · Red Hat
  7. 2026-10-12 Fix available: Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
  8. 2026-10-16 Fix available: RHSA-2026:83520 · Red Hat
  9. 2026-10-16 Fix available: RHSA-2026:83082 · Red Hat
  10. 2026-10-16 Fix available: Red Hat build of Quarkus 3.27.6.redhat, Red Hat build of Quarkus 3.33.4.redhat · Red Hat
  11. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  12. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  13. 2026-10-21 Fix available: RHSA-2026:86621 · Red Hat
  14. 2026-10-21 Fix available: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · Red Hat
  15. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  16. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  17. 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
  18. 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
  19. 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
  20. 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
  21. 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
  22. 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
  23. 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
  24. 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
  25. 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
  26. 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
  27. 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
  28. 2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +10 · Red Hat
  29. 2026-10-26 Fix available: RHSA-2026:89734 · Red Hat
  30. 2026-10-26 Fix available: Red Hat Enterprise Linux AppStream EUS (v.9.6) · Red Hat
  31. 2026-10-26 Fix available: RHSA-2026:89924 · Red Hat
  32. 2026-10-26 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.2) · Red Hat
  33. 2026-10-29 EPSS moved to the 50th–90th percentile
  34. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  35. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  36. 2026-10-30 Fix available: RHSA-2026:92858 · Red Hat
  37. 2026-10-30 Fix available: RHSA-2026:92859 · Red Hat
  38. 2026-10-30 Fix available: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9 +1 · Red Hat
  39. 2026-10-30 Fix available: RHSA-2026:92860 · Red Hat
  40. 2026-10-30 Affected versions changed · Red Hat
  41. 2026-10-30 Fix available: Red Hat Satellite 6.19 for RHEL 9 · Red Hat
  42. 2026-10-31 Fix available: RHSA-2026:92861 · Red Hat
  43. 2026-11-02 Fix available: RHSA-2026:93444 · Red Hat
  44. 2026-11-02 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.4) · Red Hat
  45. 2026-11-04 Fix available: RHSA-2026:95221 · Red Hat
  46. 2026-11-04 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
  47. 2026-11-06 Fix available: Red Hat Build of Apache Camel 3.33.4.redhat · Red Hat
  48. 2026-11-06 Fix available: RHSA-2026:83670 · Red Hat

References

Patch 2

Advisory 2

Other 6

  • TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
  • TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
  • TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
  • TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences