RHSA-2026:89924HighCVSS 7.5

Red Hat Security Advisory: jackson-databind security update

Published
October 26, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (2)

CVE-2026-68497 →CVE-2026-91777 →

📋 Description

CVE-2026-68497 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing CVE-2026-91777 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion

🎯 Affected products3

  • Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • jackson-databind-0:2.21.6-1.el9_2.1.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity. Workaround: Upgrade to a patched version. Refer to the advisory for the patched versions: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24. Example `pom.xml`: ``` <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.18.11</version> </dependency> ``` Verify: `mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind` If you cannot upgrade directly, apply defense-in-depth mitigations: - Restrict JSON request size - Audit and remove unnecessary @JsonIdentityInfo

🔗 References (5)