CVE-2026-42779

CVE-2026-42779 — Contournement du filtre de désérialisation Apache MINA menant à une exécution de code à distance CVSS 3.1 : 9.8 CRITIQUE AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE : CWE-502 Désérialisation de données non fiables Signaleur : Venkatraman Kumar, Securin Avis : Liste de diffusion Apach...

log4j2-rce

Contournement de FilteredObjectInputStream de Log4j RCE pré-authentification sur tout service Java qui désérialise des LogEvent via le FilteredObjectInputStream de Log4j. Aucune information d'identification requise. Signalé comme problème GitHub 4255 le 24 août 2026. Ce que ça fait Log4j fournit...

CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

EUVD-2026-67192

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

CVE-2026-59307

Spring Integration JdbcMessageStore has a deserialization allow-list bypass. When the store is a Spring-managed bean , calling addAllowedPatterns(...) to restrict deserialization is silently ineffective because setBeanClassLoader (invoked during Spring's bean lifecycle) replaces the deserializer ...

CVE-2026-59275

Spring AMQP versions 4.1.0, 4.0.0–4.0.4, 3.2.0–3.2.12, and 2.4.18 and earlier are affected by a remote JVM termination vulnerability. A single hostile AMQP message triggers nested-array Java deserialization that bypasses the allowlist, causing a StackOverflowError . The default JavaLangErrorHandl...

CVE-2026-59275 Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

A single hostile AMQP message can terminate the entire consumer JVM System.exit99, not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

Agent-to-controller deserialization filter bypass

Jenkins uses the https://github.com/jenkinsci/remotingRemoting library typically agent.jar or remoting.jar for communication between the controller and agents via serialized Java objects. To protect against deserialization vulnerabilities, Jenkins enforces the https://jenkins.io/jep/200JEP-200...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory 2026-08-05: SECURITY-3911 / CVE-2026-70426: Agent-to-controller deserialization filter bypass Critical SECURITY-3930 / CVE-2026-70427: Link following vulnerability allows arbitrary file creation High SECURITY-3927 / CVE-2026-70428: Path traversal vulnerability in file...

Security Bulletin: IBM WebSphere Automation is affected by multiple CVEs in the jackson-databind package

Summary IBM WebSphere Automation is affected by multiple CVEs in the jackson-databind package. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8,...

jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

Summary UnwrappedPropertyHandler.processUnwrapped replays the buffered JSON for a @JsonUnwrapped property by iterating its properties and calling prop.deserializeAndSet with no prop.visibleInViewctxt.getActiveView guard — the exact guard processUnwrappedCreatorProperties received in the 5971 /...

jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

Summary For Java Records, POJOPropertiesCollector.removeUnwantedIgnorals records a @JsonIgnore-annotated component under its original implicit name before renameUsing applies the PropertyNamingStrategy. After the rename, ignoredPropertyNames still holds only the pre-rename name, so ignorableProps...

MiracleLinux 9 : ruby:4.0 (AXSA:2026-1284:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1284:01 advisory. ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection CVE-2026-33210 erb: ERB: Arbitrary code execution via...

PYSEC-2026-2530 joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

RFC7797 b64=false JWS payloads bypass JWSRegistry payload-size limits during deserialization Summary Testing revealed that joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.maxpayloadlength. The normal JWS compact and flattened JSON paths reject payloads above...

erb: ERB: Arbitrary code execution via deserialization bypass

A flaw was found in ERB, a templating system for Ruby. An attacker who can trigger deserialization of untrusted data in a Ruby application can bypass existing protections. This vulnerability allows for arbitrary code execution by exploiting specific public methods that evaluate template source...

SUSE SLED15: jackson-annotations / jackson-core / jackson-databind / etc (SUSE-SU-2026:2801-1)

"The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2801-1 advisory. This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats- binary...

SUSE-SU-2026:2801-1 Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes the following issues - CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary...

CVE-2026-43866

Summary : CVE-2026-43866 is a deserialization bypass in Apache Camel JMS components. When mapJmsMessage is enabled, camel-jms (and camel-sjms and JMS-family components) deserialize JMS ObjectMessage payloads via ObjectMessage.getObject(). Although a post-deserialization allow-list was added in CV...

Important: Red Hat Security Advisory: ruby security update

An update for ruby is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...