Red Hat Security AdvisoryRHSA-2026:90909
pki-deps:10.6 security update
Released 2026-10-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.10.0+20993+d0f024b0.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.10.0+20993+d0f024b0.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.10.0+20993+d0f024b0.noarch::pki-deps:10.6 +47
Fixes 3 records
Priority HIGH 72
Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00487 · Published 2026-09-23 · Partial fix · 2.21.7, 3.1.7 +3 CWE-400
Priority HIGH 72
UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00532 · Published 2026-09-23 · Partial fix · 2.21.7, 2.22.3 +3 CWE-400
Priority MEDIUM 40
StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (de…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00652 · Published 2026-10-16 · Partial fix · 2.18.10, 2.21.6 +3 CWE-400
THREATIST.IORead the docs