AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-databind Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1784801122)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784801122 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0...

Rocky Linux 10.2 [CIQ] Security Update: dogtag-pki-debugsource / idm-pki-acme / idm-pki-base / idm-pki-ca / etc Multiple Vulnerabilities (crlsa-2026_43400)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202643400 advisory. jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 jackson-databind: jackson-databind: Arbitrary code...

AlmaLinux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1787889621)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787889621 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18....

Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / bea-stax-api / etc (crlsa-2019_2720)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20192720 advisory. jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution CVE-2019-12384 Tenable has extracted the...

Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / etc (crlsa-2026_43218)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202643218 advisory. jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 Tenable has extracted the preceding description block directly...

Rocky Linux 9 [CIQ] Security Update: pki-jackson-annotations / pki-jackson-core / pki-jackson-databind / etc Multiple Vulnerabilities (crlsa-2026_40895)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202640895 advisory. jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 jackson-databind: jackson-databind: Arbitrary code...

AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.2:CLSA-2025:1760018305)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760018305 advisory. - jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects...

Keycloak -- multiple vulnerabilities

The Keycloak Team reports: CVE-2026-12388: IdP mapper admin role escalation. CVE-2026-14781: OIDC broker applies idtoken emailverified to userinfo email, marking unverified addresses as verified. CVE-2026-19608: Name-only group claims let same-name groups satisfy path-specific group policies...

Security Bulletin: Vulnerabilities in Netty,jackson-databind,Angular,bootstrap,React Router,decode-uri-component,Reactor Netty,Spring WebFlux,Spring Framework,spring-web might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, jackson-databind, Angular, bootstrap, React Router, decode-uri-component, Reactor Netty, Spring WebFlux, Spring Framework,spring-web. Vulnerabilities include allowing the renamed JSON key to be assigned...

Security Bulletin: Vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer. Vulnerabilities include a crafted Host header that is only a superstring match for a configured host+path key can still route a...

GHSA-CXP5-3PX4-PW24 jackson-databind quadratic forward-reference completion

Summary When an @JsonIdentityInfo collection or map first creates N unresolved object-ID references and later resolves the same IDs in reverse order, jackson-databind scans the remaining pending-reference accumulator for each resolution. A shallow JSON document whose size grows linearly can...

EUVD-2026-85003

jackson-databind quadratic forward-reference completion...

jackson-databind quadratic forward-reference completion

Summary When an @JsonIdentityInfo collection or map first creates N unresolved object-ID references and later resolves the same IDs in reverse order, jackson-databind scans the remaining pending-reference accumulator for each resolution. A shallow JSON document whose size grows linearly can...

GHSA-WV8Q-QHHJ-9H54 jackson-databind retains every unknown raw type ID

Summary With @JsonTypeInfouse = Id.NAME, defaultImpl = ..., every distinct unknown raw type ID selects the same fallback deserializer but is retained as a separate key in TypeDeserializerBase.deserializers. An attacker who can repeatedly supply new unknown type IDs can grow this process-lifetime...

EUVD-2026-85002

jackson-databind retains every unknown raw type ID...

jackson-databind retains every unknown raw type ID

Summary With @JsonTypeInfouse = Id.NAME, defaultImpl = ..., every distinct unknown raw type ID selects the same fallback deserializer but is retained as a separate key in TypeDeserializerBase.deserializers. An attacker who can repeatedly supply new unknown type IDs can grow this process-lifetime...

Security Bulletin: Multiple Vulnerabilities in IBM DevOps Release

Summary IBM DevOps Release 7.1.0.0 addresses multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION: TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphis...

AlmaLinux 9.6 [TuxCare] Security Update: pki-jackson-databind Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784562620)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784562620 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0...

AlmaLinux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1784135237)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784135237 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8...

Rocky Linux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1784135237)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784135237 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until...