Bug 2492010 (CVE-2026-54513)

Summary: CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aakkiang, aazores, abrianik, alinfoot, anthomas, ant, anujha, aschwart, asoldano, asyoung, aszczucz, ataylor, avibelli, bbaranow, bbrownin, bgeorges, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, cfu, chfoley, cmah, dandread, dbruscin, dfreiber, dhanak, dkreling, dlofthou, drichtar, drosa, drow, dschmidt, dsimansk, dtrifiro, eaguilar, ebaron, edewata, ehelms, ehugonne, ewittman, fmariani, fmongiar, gbenhaim, ggainey, ggrzybek, gkimetto, gmalinko, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jburrell, jbuscemi, jhollowa, jkoehler, jlanda, jmagne, jmartisk, jmatsuok, jnethert, jolong, jpasqual, jpechane, jraez, jtolenti, juwatts, jwon, kaycoth, kgaikwad, kingland, kshier, kvanderr, lphiri, lthon, manderse, mcarlett, mdellweg, mfargett, mharmsen, mhulan, mnovotny, mosmerov, mposolda, msvehla, nipatil, niyer, nmoumoul, nwallace, olubyans, osousa, pantinor, parichar, pberan, pcreech, pesilva, pgallagh, pjindal, pmackay, prichard, prisingh, probinso, rbryant, rchan, rgodfrey, rguimara, rhel-process-autobot, rkubis, rmartinc, rruss, rstancel, rstepani, rsvoboda, sausingh, sbiarozk, sdawley, simaishi, skhandel, smallamp, snegrini, ssilvert, stcannon, sthirugn, sthorger, swoodman, taherrin, tasato, tcunning, teagle, thjenkin, tmalecek, tqvarnst, twaugh, vdosoudi, vkumar, vmuzikar, watson-tool-maintainers, weaton, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2492652, 2492651    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-23 22:01:57 UTC
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Comment 4 errata-xmlrpc 2026-07-08 18:28:35 UTC
This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 4.18 for Quarkus 3.33

Via RHSA-2026:36839 https://access.redhat.com/errata/RHSA-2026:36839

Comment 5 errata-xmlrpc 2026-07-16 11:56:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:40895 https://access.redhat.com/errata/RHSA-2026:40895

Comment 6 errata-xmlrpc 2026-07-20 11:57:08 UTC
This issue has been addressed in the following products:

  Red Hat Data Grid 8.6.2

Via RHSA-2026:41951 https://access.redhat.com/errata/RHSA-2026:41951

Comment 7 errata-xmlrpc 2026-07-22 05:37:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:43218 https://access.redhat.com/errata/RHSA-2026:43218

Comment 8 errata-xmlrpc 2026-07-22 10:18:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:43400 https://access.redhat.com/errata/RHSA-2026:43400

Comment 9 errata-xmlrpc 2026-07-23 00:42:59 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:44062 https://access.redhat.com/errata/RHSA-2026:44062

Comment 10 errata-xmlrpc 2026-07-23 00:44:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:44063 https://access.redhat.com/errata/RHSA-2026:44063

Comment 11 errata-xmlrpc 2026-07-23 01:03:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:44061 https://access.redhat.com/errata/RHSA-2026:44061

Comment 12 errata-xmlrpc 2026-07-23 01:09:31 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:44065 https://access.redhat.com/errata/RHSA-2026:44065

Comment 13 errata-xmlrpc 2026-07-23 01:21:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:44066 https://access.redhat.com/errata/RHSA-2026:44066

Comment 14 errata-xmlrpc 2026-07-23 01:28:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:44064 https://access.redhat.com/errata/RHSA-2026:44064

Comment 15 errata-xmlrpc 2026-07-23 06:31:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:44271 https://access.redhat.com/errata/RHSA-2026:44271

Comment 16 errata-xmlrpc 2026-07-29 19:53:40 UTC
This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2026:48151 https://access.redhat.com/errata/RHSA-2026:48151

Comment 19 errata-xmlrpc 2026-08-13 14:51:00 UTC
This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16

Via RHSA-2026:54622 https://access.redhat.com/errata/RHSA-2026:54622