Critical Security Update for jackson-databind: CVE-2026-91777
Summary
RHSA-2026:85231: Red Hat Security Advisory: jackson-databind security update. Affects jackson-databind versions < 0:2.21.6-1.el9_8.1. Fixed in 0:2.21.6-1.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jackson-databind is a core component of the Jackson library, widely used for converting Java objects to JSON and vice versa. It provides data-binding functionality, allowing developers to easily serialize and deserialize Java objects. This package is integral to many Java applications, making it crucial to maintain its security and integrity. The vulnerability identified as CVE-2026-91777 affects this package, posing significant risks to applications that rely on it.
Vulnerability Detail
CVE-2026-91777 is a security vulnerability in jackson-databind that allows for potential remote code execution due to improper handling of input data. This vulnerability can be exploited by attackers to execute arbitrary code on the server, leading to unauthorized access and data breaches. The vulnerability has a CVSS score of 7.5, indicating a high severity level, and it is critical for users to address this issue promptly to safeguard their applications.
How To Fix
Minimum fixed version
0:2.21.6-1.el9_8.1
This is the first release that contains the fix.
sudo dnf update jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize data before processing it with jackson-databind. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The vulnerability CVE-2026-91777 in the jackson-databind package poses a significant risk to applications that utilize this library. It is essential to update to the patched version to mitigate potential threats. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2026-91777 is a security vulnerability in the jackson-databind package that can lead to remote code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2026-91777 is 7.5, indicating a high severity level.
If you cannot update the package, implement input validation to sanitize data before processing it with jackson-databind as a temporary workaround.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:85231.json.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
