RHLW-2026-bcaf0a0ae0978229
- Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-bcaf0a0ae0978229.json
- Import Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-bcaf0a0ae0978229.json
- JSON Data
- https://api.osv.dev/v1/vulns/RHLW-2026-bcaf0a0ae0978229
- Upstream
- Published
- 2026-10-08T19:45:08Z
- Modified
- 2026-10-27T04:00:13Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Lightwell Security Advisory: jackson-databind 2.13.4.2-rhlw-00004
- Details
-
Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.13.4.2-rhlw-00004 with a backported security fix.
CVE-2026-91776: jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.13.4.2 from Maven Central.
- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54
- https://nvd.nist.gov/vuln/detail/CVE-2026-91776
- https://github.com/FasterXML/jackson-databind/issues/6203
- https://github.com/FasterXML/jackson-databind
- https://github.com/advisories/GHSA-wv8q-qhhj-9h54
- Credits
-
-
- Red Hat Lightwell - REMEDIATION_DEVELOPER
-
Affected packages
Red Hat Lightwell:Maven / com.fasterxml.jackson.core:jackson-databind
Package
- Name
- com.fasterxml.jackson.core:jackson-databind
- Purl
- pkg:maven/com.fasterxml.jackson.core/jackson-databind
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.13.4.2-rhlw-00004
Affected versions
2.*
2.0.0-RC1
2.0.0-RC2
2.0.0-RC3
2.0.0
2.0.1
2.0.2
2.0.4
2.0.5
2.0.6
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0-rc1
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.3.0-rc1
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0-rc1
2.4.0-rc2
2.4.0-rc3
2.4.0
2.4.1
2.4.1.1
2.4.1.2
2.4.1.3
2.4.2
2.4.3
2.4.4
2.4.5
2.4.5.1
2.4.6
2.4.6.1
2.5.0-rc1
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.6.0-rc1
2.6.0-rc2
2.6.0-rc3
2.6.0-rc4
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.7.1
2.6.7.2
2.6.7.3
2.6.7.4
2.6.7.5
2.7.0-rc1
2.7.0-rc2
2.7.0-rc3
2.7.0
2.7.1
2.7.1-1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.7.9.1
2.7.9.2
2.7.9.3
2.7.9.4
2.7.9.5
2.7.9.6
2.7.9.7
2.8.0.rc1
2.8.0.rc2
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.8.1
2.8.9
2.8.10
2.8.11
2.8.11.1
2.8.11.2
2.8.11.3
2.8.11.4
2.8.11.5
2.8.11.6
2.9.0
2.9.0.pr1
2.9.0.pr2
2.9.0.pr3
2.9.0.pr4
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.9.9
2.9.9.1
2.9.9.2
2.9.9.3
2.9.10
2.9.10.1
2.9.10.2
2.9.10.3
2.9.10.4
2.9.10.5
2.9.10.6
2.9.10.7
2.9.10.8
2.10.0
2.10.0.pr1
2.10.0.pr2
2.10.0.pr3
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.5.1
2.11.0.rc1
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0-rc1
2.12.0-rc2
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12.6.1
2.12.7
2.12.7.1
2.12.7.2
2.13.0-rc1
2.13.0-rc2
2.13.0
2.13.1
2.13.2
2.13.2.1
2.13.2.2
2.13.3
2.13.4
2.13.4.1
2.13.4.2
Database specific
lightwell
{
"backport_base_version": "2.13.4.2",
"remediated_version": "2.13.4.2-rhlw-00004",
"repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-bcaf0a0ae0978229.json"