CLSA-2026-1793957665: TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
Published Nov 6, 2026
·Updated
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.6.6-tuxcare.4.
Affected Software
1 affected componentFixes available
tuxcare/com.fasterxml.jackson.core:jackson-databind>=2.6.6<2.6.6-tuxcare.4
2.6.6-tuxcare.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tuxcare/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.6-tuxcare.4 - Upgrade
Upgrade
com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.6-tuxcare.4
Event History
Nov 6, 2026
Advisory Published
via OSV·10:34 AM
Data Sourced
via OSV·10:34 AM
DescriptionAffected Software
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
1
What package build should be deployed to obtain the fixes?
Deploy com.fasterxml.jackson.core:jackson-databind version 2.6.6-tuxcare.4, which is identified as the fixed build.
2
Does the advisory provide enough information to determine which deployments are exploitable?
No. It states that four CVEs are addressed but does not identify them or provide affected configurations, attack prerequisites, or exposure conditions.