RLSA-2026:98492: Important: jackson-databind security update
Published Nov 12, 2026
·Updated
The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.
Security Fix(es):
com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
1 affected componentFixes available
rocky-linux/jackson-databind<0:2.21.6-1.el9_8.1
0:2.21.6-1.el9_8.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/jackson-databindto a version that resolves this vulnerability.Fixed in 0:2.21.6-1.el9_8.1
Event History
Nov 12, 2026
Advisory Published
via OSV·12:04 AM
Data Sourced
via OSV·12:04 AM
DescriptionSeverityAffected Software