Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary jackson-databind-2.21.2.jar and jackson-databind-3.1.2.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518 . Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION:...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

Important: Red Hat Security Advisory: pki-deps:10.6 security update

An update for the pki-deps:10.6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-59889

creationtimestamp| type| source ---|---|--- 2026-07-22 00:19:16+00:00| seen| https://bsky.app/profile/suriq.io/post/3mr72fj3ek32v 2026-07-22 00:35:03+00:00| published-proof-of-concept| https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh 2026-07-27 03:50:57+00:00|...

ALSA-2026:43400 Important: dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: Certificate Authority CA Key Recovery Authority KRA Online Certificate Status Protocol OCSP Manager Token Key Service TKS Token Processing...

AlmaLinux 10 : dogtag-pki (ALSA-2026:43400)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:43400 advisory. jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 jackson-databind: jackson-databind: Arbitrary code...

RHEL 10 : dogtag-pki (RHSA-2026:43400)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:43400 advisory. IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the...

RHEL 8 : pki-deps:10.6 (RHSA-2026:43218)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:43218 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: jackson-databind:...

Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Security Fixes: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 For more details about the security issues, including the impact, a CVS...

AlmaLinux 8 : pki-deps:10.6 (ALSA-2026:43218)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:43218 advisory. jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 Tenable has extracted the preceding description block directly...

ALSA-2026:43218 Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Security Fixes: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 For more details about the security issues, including the impact, a CVS...

Oracle Linux 9 : jackson-annotations, / jackson-core, / jackson-databind, / jackson-jaxrs-providers, / and / jackson-modules-base (ELSA-2026-40895)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-40895 advisory. jackson-annotations 2.21-1 - Update to version 2.21 - Resolves: RHEL-188300 jackson-core 2.21.4-1 - Update to version 2.21.4 - Resolves: RHEL-188300...

EUVD-2026-44506

jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization...

GHSA-5GVW-P9QM-JGWH jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

Summary UnwrappedPropertyHandler.processUnwrapped replays the buffered JSON for a @JsonUnwrapped property by iterating its properties and calling prop.deserializeAndSet with no prop.visibleInViewctxt.getActiveView guard — the exact guard processUnwrappedCreatorProperties received in the 5971 /...

EUVD-2026-43957

jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy...

Important: Red Hat Security Advisory: Red Hat Data Grid 8.6.2 security update

An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON JavaScript Object Notation data to a service that reads and processes it. This can lead to a Denial of Service Do...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

Important: jackson-databind

Issue Overview: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator PTV is the primary safety mechanism guarding polymorphic deserialization. Wh...