Priority MEDIUM 51
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type…
RHSA-2026:91304
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.SP1)
Released 2026-10-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Build of Apache Camel 3.33.4.SP1 com.fasterxml.jackson.core.jackson-databind-2.21.8.redhat-00001.jar, com.fasterxml.jackson.dataformat.jackson-dataformat-protobuf-2.21.8.redhat-00001.jar
Fixes 3 records
Priority MEDIUM 40
ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len).
Priority LOW 39
ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic.