RHEL 9 : Satellite 6.17.11 Async Update (Important) (RHSA-2026:63387)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63387 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...

CLSA-2026-1788358728 TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.1-tuxcare.1...

CLSA-2026-1788348298 TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.14.2-tuxcare.2...

CVE-2026-59889

A flaw was found in jackson-databind. The UnwrappedPropertyHandler.processUnwrapped method, responsible for handling @JsonUnwrapped properties, replays buffered JSON without properly checking the active view. This allows an attacker to write data to a property annotated with both @JsonView and...

Security Bulletin: Multiple vulnerabilities in jackson-databind impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

Summary Multiple vulnerabilities in jackson-databind impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-18401 DESCRIPTION:...

Security Bulletin: Multiple vulnerabilities in jackson-databind impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

Summary Multiple vulnerabilities in jackson-databind impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION:...

SUSE CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

SUSE CVE-2026-83557

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

PT-2026-90699

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.1-tuxcare.1...

PT-2026-90682

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.14.2-tuxcare.2...

Linux Distros Unpatched Vulnerability : CVE-2026-83557

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom...

Linux Distros Unpatched Vulnerability : CVE-2026-19032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator in Jira Software Data Center

CVE-2026-54513 vulnerability in jackson-databind affects certain versions of Atlassian Jira Software Data Center. Atlassian recommends that Jira Software Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed...

RCE (Remote Code Execution) jackson-databind Dependency in Jira Service Management Data Center and Server

This High severity RCE Remote Code Execution vulnerability known as CVE-2026-54513 was introduced in 5.17.0 and later of Jira Service Management Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

DoS (Denial of Service) com.fasterxml.jackson.core:jackson-databind Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 5.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.1 a...

DoS (Denial of Service) com.fasterxml.jackson.core:jackson-databind Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.12.1, 9.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.1 and...

Deserialization of Untrusted Data

Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the isSafeSubType method of...

DEBIAN-CVE-2026-83557

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2026-83557

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2026-83557

jackson-databind ships a default PolymorphicTypeValidator (DefaultBaseTypeLimitingValidator) used automatically when @JsonTypeInfo is present without a custom validator. The flaw: java.lang.Comparable was omitted from its "unsafe base types" deny-list, so isSafeSubType returned true unconditional...