CLSA-2026-1794556963: TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)

Q: How can I triage whether an installed package needs this update?

Compare the installed com.fasterxml.jackson.core:jackson-databind build with 2.9.8-tuxcare.7, the build identified as containing the fixes. The advisory does not provide an affected-version range or configuration conditions.

Q: Are workaround or mitigation options provided for systems that cannot update immediately?

No workaround, temporary mitigation, or configuration change is provided in the advisory.

Q: Does the advisory identify the individual CVEs addressed?

No. It states that three CVEs are addressed but does not list their identifiers or technical details.

Published Nov 13, 2026

Updated

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.9.8-tuxcare.7.

Affected Software

1 affected componentFixes available

tuxcare/com.fasterxml.jackson.core:jackson-databind>=2.9.8<2.9.8-tuxcare.7

2.9.8-tuxcare.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tuxcare/com.fasterxml.jackson.core:jackson-databind to a version that resolves this vulnerability.
Fixed in 2.9.8-tuxcare.7
Upgrade
Upgrade com.fasterxml.jackson.core:jackson-databind to a version that resolves this vulnerability.
Fixed in 2.9.8-tuxcare.7

Event History

Nov 13, 2026

Advisory Published

via OSV·09:02 AM

Data Sourced

via OSV·09:02 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

How can I triage whether an installed package needs this update?

Compare the installed com.fasterxml.jackson.core:jackson-databind build with 2.9.8-tuxcare.7, the build identified as containing the fixes. The advisory does not provide an affected-version range or configuration conditions.

Are workaround or mitigation options provided for systems that cannot update immediately?