FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade jackson-databind | Apr 26, 2021 | Dec 27, 2020 |
| Suse | — | Upgrade jackson-databindUpgrade jackson-databind-javadoc | Feb 2, 2021 | Dec 27, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 27, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub