CLEANSTART-2026-OP16049 Security fix for CVE-2026-54515 applied in: activemq 6.1.8-r1, activemq 6.2.8-r2, activemq 6.3.1-r1, apache-hive 4.1.0-r5, apache-nifi 2.10.0-r3, apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3, apache-zookeeper 3.8.6-r5, apache-zookeeper 3.9.5-r5, cassandra 5.0.8-r1, cassandra-reaper-fips 3.8.0-r9, cassandra-reaper-fips 4.0.2-r3, cassandra-reaper-fips 4.1.1-r2, cassandra-reaper-fips 4.2.5-r1, elasticsearch 9.2.8-r1, elasticsearch 9.3.5-r2, elasticsearch 9.4.4-r4, gradle 9.7.1-r0, hazelcast 5.7.0-r1, kafka 4.3.1-r1, keycloak 26.4.13-r1, keycloak 26.4.7-r4, keycloak 26.5.7-r5, keycloak 26.6.3-r3, keycloak 26.6.4-r1, keycloak 26.7.0-r1, kserve-modelmesh 0.12.0-r17, logstash-fips 9.4.3-r1, rundeck 6.0.0-r2, rundeck 6.0.1-r0, s3proxy 3.3.0-r1, solr 10.0.0-r5, solr 9.10.1-r7, solr 9.8.1-r1, sonarqube 26.3.0.120487-r4, spark 3.5.9-r1, spark-sc212-jdk17-py311 3.4.4-r0, spark-sc213-jdk17-py312 3.4.4-r1, spark-sc213-jdk17-py312 3.5.8-r0, spark-sc213-jdk17-py312 4.0.3-r0, spark-sc213-jdk17-py312 4.1.2-r0, strimzi-kafka-operator 1.1.0-r1, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, trino 480-r7, wso2is 7.0.0-r1, wso2is 7.1.0-r1, wso2is 7.2.0-r1

CVE-2026-54515 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HU47571 Security fixes in gradle 9.7.1-r0

Package gradle version 9.7.1-r0 fixes 3 vulnerabilities: CVE-2026-59889, CVE-2026-54515, CVE-2026-71497...

CLEANSTART-2026-ZY59123 Security fixes in activemq 6.1.8-r1

Package activemq version 6.1.8-r1 fixes 18 vulnerabilities: CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516...

CLEANSTART-2026-OX23337 Security fixes in spark 3.5.9-r1

Package spark version 3.5.9-r1 fixes 12 vulnerabilities: CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, ghsa-rmj7-2vxq-3g9f...

Security Bulletin:Vulnerability in jackson-databind affects IBM Netezza Appliance

Summary The jackson-databind package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-54515, CVE-2026-59889 Vulnerability Details CVEID:CVE-2026-54515 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and...

CLEANSTART-2026-NP03031 Security fixes in apache-zookeeper 3.9.5-r5

Package apache-zookeeper version 3.9.5-r5 fixes 4 vulnerabilities: ghsa-r7wm-3cxj-wff9, CVE-2026-54515, CVE-2026-59889, ghsa-mhm7-754m-9p8w...

CLEANSTART-2026-JU83352 Security fixes in wildfly 40.0.1-r2

Package wildfly version 40.0.1-r2 fixes 2 vulnerabilities: ghsa-5jmj-h7xm-6q6v, CVE-2026-54515...

Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues: CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions...

SUSE-SU-2026:3273-1 Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues: - CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions...

Security Bulletin: Multiple vulnerabilities found in IBM ApplinX.

Summary IBM ApplinX has been updated in order to address multiple vulnerabilities CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, CVE-2026-59889, CVE-2026-55223. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary jackson-databind-2.21.2.jar and jackson-databind-3.1.2.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518 . Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION:...

Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes the following issues CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary...

SUSE SLES16: jackson-annotations / jackson-annotations-javadoc / jackson-core / etc (SUSE-SU-2026:22504-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22504-1 advisory. This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues - CVE-2026-54512: jackson-databind...

CVE-2026-54515

creationtimestamp| type| source ---|---|--- 2026-06-24 00:39:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyoilsxlk2y 2026-06-29 13:58:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgnhh3jnf2d 2026-09-25 05:40:11+00:00| seen|...

ai.covia:covia-discord (>=0.9.8, <=0.9.9), ai.dezifi:dezifi-dak (>=0.1.0-beta.1, <=0.1.0) +6429 more potentially affected by CVE-2026-54515 via com.fasterxml.jackson.core:jackson-databind (2.22.0)

com.fasterxml.jackson.core:jackson-databind MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.fasterxml.jackson.core:jackson-databind and may be impacted: - ai.covia:covia-discord =0.9.8, =0.1.0-beta.1, =1.4.0, =1.4.0, =1.4.0,...

ac.pao:reports-web (1.0.0), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +34057 more potentially affected by CVE-2026-54515 via com.fasterxml.jackson.core:jackson-databind (>=2.19.0, <=2.21.4)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.19.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.6 and more Source cves:...

ai.covia:covia-discord (>=0.9.8, <=0.9.9), ai.dezifi:dezifi-dak (>=0.1.0-beta.1, <=0.1.0) +6429 more potentially affected by CVE-2026-54515 via com.fasterxml.jackson.core:jackson-databind (2.22.0)

com.fasterxml.jackson.core:jackson-databind MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.fasterxml.jackson.core:jackson-databind and may be impacted: - ai.covia:covia-discord =0.9.8, =0.1.0-beta.1, =1.4.0, =1.4.0, =1.4.0,...

ai.abkr.open:any (>=1.0.6, <=1.0.22), ai.pipestream.proto-toolchain:ai.pipestream.proto-toolchain.gradle.plugin (>=0.7.18, <=0.7.21) +5537 more potentially affected by CVE-2026-54515 via tools.jackson.core:jackson-databind (>=3.1.0, <=3.1.3)

tools.jackson.core:jackson-databind MAVEN version =3.1.0, =1.0.6, =0.7.18, =0.7.18, =4.13.5, =4.7.3, =2.0.0, =2.0.0, =2.0.0-beta-2, =2.0.0-beta-1, =2.0.0-beta-1, =2.0.0-beta-1, =2.0.0-beta-1, =2.0.29, =2.0.0-alpha1, =2.0.0-alpha3 and more Source cves: CVE-2026-54515 Source advisory:...

ai.covia:covia-discord (>=0.9.8, <=0.9.9), ai.dezifi:dezifi-dak (>=0.1.0-beta.1, <=0.1.0) +6429 more potentially affected by CVE-2026-54515 via com.fasterxml.jackson.core:jackson-databind (2.22.0)

com.fasterxml.jackson.core:jackson-databind MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.fasterxml.jackson.core:jackson-databind and may be impacted: - ai.covia:covia-discord =0.9.8, =0.1.0-beta.1, =1.4.0, =1.4.0, =1.4.0,...

DEBIAN-CVE-2026-54515

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual, per-property @JsonIgnoreProperties exclusions are applied by handleByNameInclusion, producing a...