Bug 2492010 (CVE-2026-54513)
| Summary: | CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aakkiang, aazores, abrianik, alinfoot, anthomas, ant, anujha, aschwart, asoldano, asyoung, aszczucz, ataylor, avibelli, bbaranow, bbrownin, bgeorges, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, cfu, chfoley, cmah, dandread, dbruscin, dfreiber, dhanak, dkreling, dlofthou, drichtar, drosa, drow, dschmidt, dsimansk, dtrifiro, eaguilar, ebaron, edewata, ehelms, ehugonne, ewittman, fmariani, fmongiar, gbenhaim, ggainey, ggrzybek, gkimetto, gmalinko, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jburrell, jbuscemi, jhollowa, jkoehler, jlanda, jmagne, jmartisk, jmatsuok, jnethert, jolong, jpasqual, jpechane, jraez, jtolenti, juwatts, jwon, kaycoth, kgaikwad, kingland, kshier, kvanderr, lphiri, lthon, manderse, mcarlett, mdellweg, mfargett, mharmsen, mhulan, mnovotny, mosmerov, mposolda, msvehla, nipatil, niyer, nmoumoul, nwallace, olubyans, osousa, pantinor, parichar, pberan, pcreech, pesilva, pgallagh, pjindal, pmackay, prichard, prisingh, probinso, rbryant, rchan, rgodfrey, rguimara, rhel-process-autobot, rkubis, rmartinc, rruss, rstancel, rstepani, rsvoboda, sausingh, sbiarozk, sdawley, simaishi, skhandel, smallamp, snegrini, ssilvert, stcannon, sthirugn, sthorger, swoodman, taherrin, tasato, tcunning, teagle, thjenkin, tmalecek, tqvarnst, twaugh, vdosoudi, vkumar, vmuzikar, watson-tool-maintainers, weaton, yfang, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2492652, 2492651 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-06-23 22:01:57 UTC
This issue has been addressed in the following products: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 Via RHSA-2026:36839 https://access.redhat.com/errata/RHSA-2026:36839 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:40895 https://access.redhat.com/errata/RHSA-2026:40895 This issue has been addressed in the following products: Red Hat Data Grid 8.6.2 Via RHSA-2026:41951 https://access.redhat.com/errata/RHSA-2026:41951 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:43218 https://access.redhat.com/errata/RHSA-2026:43218 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:43400 https://access.redhat.com/errata/RHSA-2026:43400 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:44062 https://access.redhat.com/errata/RHSA-2026:44062 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:44063 https://access.redhat.com/errata/RHSA-2026:44063 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:44061 https://access.redhat.com/errata/RHSA-2026:44061 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:44065 https://access.redhat.com/errata/RHSA-2026:44065 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:44066 https://access.redhat.com/errata/RHSA-2026:44066 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:44064 https://access.redhat.com/errata/RHSA-2026:44064 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:44271 https://access.redhat.com/errata/RHSA-2026:44271 This issue has been addressed in the following products: Cryostat 4 on RHEL 9 Via RHSA-2026:48151 https://access.redhat.com/errata/RHSA-2026:48151 This issue has been addressed in the following products: Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16 Via RHSA-2026:54622 https://access.redhat.com/errata/RHSA-2026:54622 |