Package
jenkins-2.568
Component
jackson-databind
Latest update
Fixed version
2.568.3-r4
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
2.568.3-r4Status
Impact
The jackson-databind copy in jenkins.war is bundled inside the Jenkins jackson2-api plugin, which is packaged in the war, and cannot be updated independently of a jackson2-api plugin release. CVE-2026-91776 is fixed in jackson-databind 2.22.3. No jackson2-api plugin release ships it: 2.22.2-445.vdc613f1d8012, the latest release and the one this package already includes, bundles jackson-databind 2.22.2. The plugin's upgrade to Jackson 2.22.3 is open upstream and not yet merged. Waiting for the first upstream release containing the fix.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-91776 https://github.com/advisories/GHSA-wv8q-qhhj-9h54 https://github.com/jenkinsci/jackson2-api-plugin/pull/351 https://github.com/jenkinsci/jackson2-api-plugin/releases/tag/2.22.2-445.vdc613f1d8012 https://plugins.jenkins.io/jackson2-api/
Status