CLSA-2026-1793532508: TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)

Q: Which version includes the fixes?

The two CVEs are addressed in com.fasterxml.jackson.core:jackson-databind version 2.13.5-tuxcare.3.

Q: How can I determine whether my deployment is affected?

Check the installed version of the TuxCare com.fasterxml.jackson.core:jackson-databind package. Systems running a version earlier than 2.13.5-tuxcare.3 have not received the fixes identified by this update.

Published Nov 1, 2026

Updated

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.13.5-tuxcare.3.

Affected Software

1 affected componentFixes available

tuxcare/com.fasterxml.jackson.core:jackson-databind>=2.13.5<2.13.5-tuxcare.3

2.13.5-tuxcare.3

Event History

Nov 1, 2026

Advisory Published

via OSV·12:28 PM

Data Sourced

via OSV·12:28 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-91776
CVE-2026-91777

Frequently Asked Questions

Which version includes the fixes?

The two CVEs are addressed in com.fasterxml.jackson.core:jackson-databind version 2.13.5-tuxcare.3.

How can I determine whether my deployment is affected?

Check the installed version of the TuxCare com.fasterxml.jackson.core:jackson-databind package. Systems running a version earlier than 2.13.5-tuxcare.3 have not received the fixes identified by this update.