RHSA-2026:98492: Important: jackson-databind security update
The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.Security Fix(es): com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.21.6-1.el9_9.1 - Upgrade
Upgrade
redhat/pki-jackson-databindto a version that resolves this vulnerability.Fixed in 2.21.6-1.el9_9.1
Event History
Frequently Asked Questions
Which Red Hat software packages are covered by this update?
The update covers redhat/jackson-databind and redhat/pki-jackson-databind.
What is the security impact addressed by this update?
It addresses CVE-2026-91777, a denial-of-service issue caused by quadratic forward-reference completion in jackson-databind.