Priority MEDIUM 51
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type…
RHSA-2026:90311
Red Hat build of Quarkus 3.33.4.SP1 release and security update
Released 2026-10-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat build of Quarkus 3.33.4.SP1