{
  "document" : {
    "aggregate_severity" : {
      "namespace" : "https://access.redhat.com/security/updates/classification/",
      "text" : "Important"
    },
    "category" : "csaf_security_advisory",
    "csaf_version" : "2.0",
    "distribution" : {
      "text" : "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "en",
    "notes" : [ {
      "category" : "summary",
      "text" : "An update for jackson-databind is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
      "title" : "Topic"
    }, {
      "category" : "general",
      "text" : "The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.\n\nSecurity Fix(es):\n\n* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497)\n\n* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
      "title" : "Details"
    }, {
      "category" : "legal_disclaimer",
      "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
      "title" : "Terms of Use"
    } ],
    "publisher" : {
      "category" : "vendor",
      "contact_details" : "https://access.redhat.com/security/team/contact/",
      "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name" : "Red Hat Product Security",
      "namespace" : "https://www.redhat.com"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "https://access.redhat.com/errata/RHSA-2026:89924",
      "url" : "https://access.redhat.com/errata/RHSA-2026:89924"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/updates/classification/#important",
      "url" : "https://access.redhat.com/security/updates/classification/#important"
    }, {
      "category" : "external",
      "summary" : "2531964",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2531964"
    }, {
      "category" : "external",
      "summary" : "2539085",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2539085"
    }, {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_89924.json"
    } ],
    "title" : "Red Hat Security Advisory: jackson-databind security update",
    "tracking" : {
      "current_release_date" : "2026-11-09T16:38:29+00:00",
      "generator" : {
        "date" : "2026-11-09T16:38:29+00:00",
        "engine" : {
          "name" : "Red Hat SDEngine",
          "version" : "5.4.5"
        }
      },
      "id" : "RHSA-2026:89924",
      "initial_release_date" : "2026-10-26T13:39:14+00:00",
      "revision_history" : [ {
        "date" : "2026-10-26T13:39:14+00:00",
        "number" : "1",
        "summary" : "Initial version"
      }, {
        "date" : "2026-10-26T13:39:14+00:00",
        "number" : "2",
        "summary" : "Last updated version"
      }, {
        "date" : "2026-11-09T16:38:29+00:00",
        "number" : "3",
        "summary" : "Last generated version"
      } ],
      "status" : "final",
      "version" : "3"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_name",
          "name" : "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product" : {
            "name" : "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
            "product_id" : "AppStream-9.2.0.Z.E4S",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:redhat:rhel_e4s:9.2::appstream"
            }
          }
        } ],
        "category" : "product_family",
        "name" : "Red Hat Enterprise Linux"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "jackson-databind-0:2.21.6-1.el9_2.1.src",
          "product" : {
            "name" : "jackson-databind-0:2.21.6-1.el9_2.1.src",
            "product_id" : "jackson-databind-0:2.21.6-1.el9_2.1.src",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/jackson-databind@2.21.6-1.el9_2.1?arch=src"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "src"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch",
          "product" : {
            "name" : "pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch",
            "product_id" : "pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/pki-jackson-databind@2.21.6-1.el9_2.1?arch=noarch"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "noarch"
      } ],
      "category" : "vendor",
      "name" : "Red Hat"
    } ],
    "relationships" : [ {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "jackson-databind-0:2.21.6-1.el9_2.1.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
        "product_id" : "AppStream-9.2.0.Z.E4S:jackson-databind-0:2.21.6-1.el9_2.1.src"
      },
      "product_reference" : "jackson-databind-0:2.21.6-1.el9_2.1.src",
      "relates_to_product_reference" : "AppStream-9.2.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
        "product_id" : "AppStream-9.2.0.Z.E4S:pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch"
      },
      "product_reference" : "pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch",
      "relates_to_product_reference" : "AppStream-9.2.0.Z.E4S"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2026-68497",
    "cwe" : {
      "id" : "CWE-400",
      "name" : "Uncontrolled Resource Consumption"
    },
    "discovery_date" : "2026-09-11T16:01:15.919616+00:00",
    "ids" : [ {
      "system_name" : "Red Hat Bugzilla ID",
      "text" : "2531964"
    } ],
    "notes" : [ {
      "category" : "description",
      "text" : "A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service (DoS) by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` fields from JSON strings, where the system processes arbitrarily long numeric components. This can lead to high CPU utilization, potentially saturating server worker threads and making the service unavailable.",
      "title" : "Vulnerability description"
    }, {
      "category" : "summary",
      "text" : "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing",
      "title" : "Vulnerability summary"
    }, {
      "category" : "other",
      "text" : "A flaw in jackson-databind allows remote attackers to consume excessive CPU by submitting specially crafted JSON with unbounded numeric values, causing a denial of service.",
      "title" : "Statement"
    }, {
      "category" : "general",
      "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
      "title" : "CVSS score applicability"
    } ],
    "product_status" : {
      "fixed" : [ "AppStream-9.2.0.Z.E4S:jackson-databind-0:2.21.6-1.el9_2.1.src", "AppStream-9.2.0.Z.E4S:pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch" ]
    },
    "references" : [ {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-68497"
    }, {
      "category" : "external",
      "summary" : "RHBZ#2531964",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2531964"
    }, {
      "category" : "external",
      "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-68497",
      "url" : "https://www.cve.org/CVERecord?id=CVE-2026-68497"
    }, {
      "category" : "external",
      "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68497",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68497"
    }, {
      "category" : "external",
      "summary" : "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd",
      "url" : "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd"
    }, {
      "category" : "external",
      "summary" : "https://github.com/FasterXML/jackson-databind/pull/6127",
      "url" : "https://github.com/FasterXML/jackson-databind/pull/6127"
    }, {
      "category" : "external",
      "summary" : "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7",
      "url" : "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"
    } ],
    "release_date" : "2026-09-11T15:49:30.366000+00:00",
    "remediations" : [ {
      "category" : "vendor_fix",
      "date" : "2026-10-26T13:39:14+00:00",
      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
      "product_ids" : [ "AppStream-9.2.0.Z.E4S:jackson-databind-0:2.21.6-1.el9_2.1.src", "AppStream-9.2.0.Z.E4S:pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch" ],
      "restart_required" : {
        "category" : "none"
      },
      "url" : "https://access.redhat.com/errata/RHSA-2026:89924"
    }, {
      "category" : "workaround",
      "details" : "Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.",
      "product_ids" : [ "AppStream-9.2.0.Z.E4S:jackson-databind-0:2.21.6-1.el9_2.1.src", "AppStream-9.2.0.Z.E4S:pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch" ]
    } ],
    "scores" : [ {
      "cvss_v3" : {
        "attackComplexity" : "LOW",
        "attackVector" : "NETWORK",
        "availabilityImpact" : "HIGH",
        "baseScore" : 7.5,
        "baseSeverity" : "HIGH",
        "confidentialityImpact" : "NONE",
        "integrityImpact" : "NONE",
        "privilegesRequired" : "NONE",
        "scope" : "UNCHANGED",
        "userInteraction" : "NONE",
        "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "version" : "3.1"
      },
      "products" : [ "AppStream-9.2.0.Z.E4S:jackson-databind-0:2.21.6-1.el9_2.1.src", "AppStream-9.2.0.Z.E4S:pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch" ]
    } ],
    "threats" : [ {
      "category" : "impact",
      "details" : "Important"
    } ],
    "title" : "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing"
  }, {
    "cve" : "CVE-2026-91777",
    "cwe" : {
      "id" : "CWE-606",
      "name" : "Unchecked Input for Loop Condition"
    },
    "discovery_date" : "2026-09-23T02:31:01.024251+00:00",
    "ids" : [ {
      "system_name" : "Red Hat Bugzilla ID",
      "text" : "2539085"
    } ],
    "notes" : [ {
      "category" : "description",
      "text" : "A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing of forward-references, where the system performs a quadratic amount of work for linearly growing input, leading to excessive CPU consumption.",
      "title" : "Vulnerability description"
    }, {
      "category" : "summary",
      "text" : "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion",
      "title" : "Vulnerability summary"
    }, {
      "category" : "other",
      "text" : "A flaw was found in jackson-databind. Forward-reference completion for `@JsonIdentityInfo` object IDs in `CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()` and the equivalent implementation in `MapDeserializer` performs a linear scan of the pending-reference accumulator for every resolved ID.\n\nWhen a document creates unresolved object-ID references in an identity-enabled collection or map and then defines those IDs in reverse order, completion performs quadratic CPU work, allowing an attacker to cause a Denial of Service by sending specially crafted JSON input.\n\nExploitation requires an application that deserializes attacker-influenced JSON into an `@JsonIdentityInfo`-annotated collection or map.\n\nThe fix replaces the repeated linear lookup with a keyed pending-reference structure.",
      "title" : "Statement"
    }, {
      "category" : "general",
      "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
      "title" : "CVSS score applicability"
    } ],
    "product_status" : {
      "fixed" : [ "AppStream-9.2.0.Z.E4S:jackson-databind-0:2.21.6-1.el9_2.1.src", "AppStream-9.2.0.Z.E4S:pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch" ]
    },
    "references" : [ {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-91777"
    }, {
      "category" : "external",
      "summary" : "RHBZ#2539085",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2539085"
    }, {
      "category" : "external",
      "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-91777",
      "url" : "https://www.cve.org/CVERecord?id=CVE-2026-91777"
    }, {
      "category" : "external",
      "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-91777",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-91777"
    }, {
      "category" : "external",
      "summary" : "https://github.com/FasterXML/jackson-databind/issues/6204",
      "url" : "https://github.com/FasterXML/jackson-databind/issues/6204"
    }, {
      "category" : "external",
      "summary" : "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24",
      "url" : "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"
    } ],
    "release_date" : "2026-09-23T02:21:48.323000+00:00",
    "remediations" : [ {
      "category" : "vendor_fix",
      "date" : "2026-10-26T13:39:14+00:00",
      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
      "product_ids" : [ "AppStream-9.2.0.Z.E4S:jackson-databind-0:2.21.6-1.el9_2.1.src", "AppStream-9.2.0.Z.E4S:pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch" ],
      "restart_required" : {
        "category" : "none"
      },
      "url" : "https://access.redhat.com/errata/RHSA-2026:89924"
    }, {
      "category" : "workaround",
      "details" : "Upgrade to a patched version. Refer to the advisory for the patched versions: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24.\n\nExample `pom.xml`:\n```\n<dependency>\n    <groupId>com.fasterxml.jackson.core</groupId>\n    <artifactId>jackson-databind</artifactId>\n    <version>2.18.11</version>\n</dependency>\n```\n\nVerify: `mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind`\n\nIf you cannot upgrade directly, apply defense-in-depth mitigations:\n- Restrict JSON request size\n- Audit and remove unnecessary @JsonIdentityInfo",
      "product_ids" : [ "AppStream-9.2.0.Z.E4S:jackson-databind-0:2.21.6-1.el9_2.1.src", "AppStream-9.2.0.Z.E4S:pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch" ]
    } ],
    "scores" : [ {
      "cvss_v3" : {
        "attackComplexity" : "LOW",
        "attackVector" : "NETWORK",
        "availabilityImpact" : "HIGH",
        "baseScore" : 7.5,
        "baseSeverity" : "HIGH",
        "confidentialityImpact" : "NONE",
        "integrityImpact" : "NONE",
        "privilegesRequired" : "NONE",
        "scope" : "UNCHANGED",
        "userInteraction" : "NONE",
        "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "version" : "3.1"
      },
      "products" : [ "AppStream-9.2.0.Z.E4S:jackson-databind-0:2.21.6-1.el9_2.1.src", "AppStream-9.2.0.Z.E4S:pki-jackson-databind-0:2.21.6-1.el9_2.1.noarch" ]
    } ],
    "threats" : [ {
      "category" : "impact",
      "details" : "Important"
    } ],
    "title" : "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion"
  } ]
}