Red Hat Security Advisory: jackson-databind security update

The jackson-databind library, a general-purpose data-binding and tree-model component for the Jackson Data Processor, contains a vulnerability (CVE-2026-91777) that can cause a denial of service through quadratic forward-reference completion. This issue affects Red Hat Enterprise Linux 9 across multiple supported architectures. Red Hat has released updated jackson-databind packages (version 2.21.6-1.el9_8.1) to fix this vulnerability. The advisory classifies the security impact as important and recommends applying the update. No CVSS score is provided in the advisory, and no active exploitation has been reported.

The vulnerability allows an attacker to cause a denial of service condition in applications using jackson-databind by exploiting quadratic forward-reference completion. This can lead to resource exhaustion or application unavailability. The impact is rated as important/high severity by Red Hat. There are no reports of known exploits in the wild at this time.

Red Hat has released patched versions of jackson-databind for Red Hat Enterprise Linux 9. Users should apply the updates as described in the Red Hat advisory RHSA-2026:85231 and the update instructions at https://access.redhat.com/articles/11258. Applying these updates will remediate the vulnerability. No additional mitigation steps are indicated by the vendor.