Security Bulletin: IBM Maximo Application Suite uses jackson-databind-2.18.10.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777.

Summary IBM Maximo Application Suite uses jackson-databind-2.18.10.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION: TypeDeserializerBase.findDeserializ...

Security Bulletin: IBM Test Accelerator for Z uses jackson-databind-2.22.2.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777

Summary IBM Test Accelerator for Z uses jackson-databind-2.22.2.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777. This security bulletin provides details about the vulnerability and the corresponding remediation. Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION:...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumption issues in FasterXML jackson-databind

Summary IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumption issues in FasterXML jackson-databind. FasterXML jackson-databind is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-91776 and CVE-2026-91777 Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION: TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplie...

CVE-2026-110833

A flaw was found in FreeRDP. The proxy component fails to enforce cumulative or absolute size limits when reassembling Remote Desktop Protocol Device Redirection RDPDR channel fragments. A remote attacker can exploit this vulnerability by transmitting an initial fragment followed by continuous da...

CVE-2026-110833 FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy

FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and...

EUVD-2026-85002

jackson-databind retains every unknown raw type ID...

CVE-2026-54873 QUIC STREAM Fragment Metadata DoS

Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for...

CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

SUSE CVE-2026-91776

TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfouse = Id.NAME, defaultImpl = ..., every distinct unrecognized type ID...

CVE-2026-91776

TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfouse = Id.NAME, defaultImpl = ..., every distinct unrecognized type ID...

CVE-2026-91776: Uncontrolled Resource Consumption

TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfouse = Id.NAME, defaultImpl = ..., every distinct unrecognized type ID...

PT-2026-97133

Name of the Vulnerable Software and Affected Versions jackson-databind affected versions not specified Description The findDeserializer function in TypeDeserializerBase caches resolved deserializers using the raw type ID provided by the user. In configurations using name-based polymorphism with a...

CVE-2026-57497

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A...

CVE-2026-75135 UpSignOn < 7.19.0 Sensitive Key Retention in Memory

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

CVE-2026-75135 UpSignOn < 7.19.0 Sensitive Key Retention in Memory

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

CVE-2026-13505

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-48025 nebula-mesh: Decrypted CA private key persists in heap after signing

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at...