CLSA-2026-1794226743: TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)

Q: Which package build includes the fixes?

The 12 CVE fixes are included in com.fasterxml.jackson.core:jackson-databind version 2.10.2-tuxcare.5.

Q: Can this advisory be used to determine whether a deployed application is vulnerable?

Only if the deployed application’s jackson-databind package version can be compared with the fixed build, 2.10.2-tuxcare.5. The advisory does not provide affected version ranges, CVE identifiers, or configuration-specific exposure details.

Published Nov 9, 2026

Updated

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.10.2-tuxcare.5.

Affected Software

1 affected componentFixes available

tuxcare/com.fasterxml.jackson.core:jackson-databind>=2.10.2<2.10.2-tuxcare.5

2.10.2-tuxcare.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tuxcare/com.fasterxml.jackson.core:jackson-databind to a version that resolves this vulnerability.
Fixed in 2.10.2-tuxcare.5
Upgrade
Upgrade com.fasterxml.jackson.core:jackson-databind to a version that resolves this vulnerability.
Fixed in 2.10.2-tuxcare.5

Event History

Nov 9, 2026

Advisory Published

via OSV·01:19 PM

Data Sourced

via OSV·01:19 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which package build includes the fixes?

The 12 CVE fixes are included in com.fasterxml.jackson.core:jackson-databind version 2.10.2-tuxcare.5.

Can this advisory be used to determine whether a deployed application is vulnerable?