Read the docs
TI-2026-39358 Aliases CVE-2026-54512GHSA-j3rv-43j4-c7qm

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

Priority HIGH 70CWE-184Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 63 fixed, 16 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01066 64th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial jackson-databind (FasterXML): 2.18.8, 2.21.4, 3.1.4com.fasterxml.jackson.core:jackson-databind (Maven): 2.18.8, 3.1.4, 2.21.4+1 more productRed Hat: 62 advisoriesRed Hat: 63 fixed, 16 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FasterXMLjackson-databind2.10.0 to before 2.18.8; 2.19.0 to before 2.21.4; 3.0.0 to before 3.1.42.18.8, 2.21.4, 3.1.4Patch availableCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)2.10.0 to before 2.18.82.18.8Patch availableGHSA-j3rv-43j4-c7qm
—com.fasterxml.jackson.core:jackson-databind (Maven)3.0.0 to before 3.1.43.1.4Patch availableGHSA-j3rv-43j4-c7qm
—com.fasterxml.jackson.core:jackson-databind (Maven)2.19.0 to before 2.21.42.21.4Patch availableGHSA-j3rv-43j4-c7qm
—tools.jackson.core:jackson-databind (Maven)3.0.0 to before 3.1.43.1.4Patch availableGHSA-j3rv-43j4-c7qm
  • jackson-databind VendorFasterXML Affected 2.10.0 to before 2.18.8; 2.19.0 to before 2.21.4; 3.0.0 to before 3.1.4 Fixed in 2.18.8, 2.21.4, 3.1.4 Patch available CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.10.0 to before 2.18.8 Fixed in 2.18.8 Patch available GHSA-j3rv-43j4-c7qm
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 3.0.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-j3rv-43j4-c7qm
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.19.0 to before 2.21.4 Fixed in 2.21.4 Patch available GHSA-j3rv-43j4-c7qm
  • tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.0.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-j3rv-43j4-c7qm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*2.10.0 to before 2.18.8; 2.19.0 to before 2.21.4; 3.0.0 to before 3.1.4VulnerableFasterXML
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.10.0 to before 2.18.8; 2.19.0 to before 2.21.4; 3.0.0 to before 3.1.4 Vulnerable ·FasterXML

Remediation

  • Fix · CNA jackson-databind (FasterXML) Fixed in 2.18.8, 2.21.4, 3.1.4
  • Fix · GHSA-j3rv-43j4-c7qm com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.18.8 Advisory →
  • Fix · GHSA-j3rv-43j4-c7qm com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 3.1.4 Advisory →
  • Fix · GHSA-j3rv-43j4-c7qm com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.21.4 Advisory →
  • Fix · GHSA-j3rv-43j4-c7qm tools.jackson.core:jackson-databind (Maven) Fixed in 3.1.4 Advisory →

Red Hat 62 advisories

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:76128 Released 2026-10-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el7sso
  • RHSA-2026:76130 Released 2026-10-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el9sso
Show 59 more Red Hat advisories
  • RHSA-2026:76129 Released 2026-10-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el8sso
  • RHSA-2026:76637 Released 2026-10-06 · Red Hat rating Important
    Apicurio Registry (container images) release and security update [ 3.3.3 GA ]
    • Red Hat build of Apicurio Registry 3.3.3
  • RHSA-2026:76134 Released 2026-10-05 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 for OpenShift image security update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2026:76132 Released 2026-10-05 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 security update
    • Red Hat Single Sign-On 7.6.13
  • RHSA-2026:76043 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.7 security update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:76041 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.7 security update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:70277 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.8.GA com.fasterxml.jackson.core.jackson-core-2.18.9.redhat-00003.jar, com.fasterxml.jackson.core.jackson-databind-2.18.9.redhat-00003.jar, io.netty.netty-codec-4.1.136.Final-redhat-00001.jar +17
  • RHSA-2026:70230 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 10 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el10eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el10eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el10eap +47
  • RHSA-2026:70228 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el8eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el8eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el8eap +47
  • RHSA-2026:70229 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el9eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el9eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el9eap +47
  • RHSA-2026:69459 Released 2026-09-21 · Red Hat rating Important
    AMQ Clients 2026.Q3
    • AMQ Clients 2026.Q3
  • RHSA-2026:68699 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:66545 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.6 release and security update
    • Red Hat AMQ Broker 7.13.6
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:63327 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.16.13 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 openvox-server-8.15.2-1.el8sat, python-aiohttp-3.14.3-1.el8pc, python3.11-aiohttp-3.14.3-1.el8pc +1
    • Red Hat Satellite 6.16 for RHEL 9 openvox-server-8.15.2-1.el9sat, python-aiohttp-3.14.3-1.el9pc, python3.11-aiohttp-3.14.3-1.el9pc +1
  • RHSA-2026:63385 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.19.4 Async Update
    • Red Hat Satellite 6.19 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
  • RHSA-2026:63387 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.17.11 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
  • RHSA-2026:63386 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.18.9 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +4
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:61627 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:60259 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60256 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60254 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60252 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60251 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60250 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60249 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60248 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60247 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60246 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60239 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:54622 Released 2026-08-13 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.3 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
  • RHSA-2026:54440 Released 2026-08-12 · Red Hat rating Important
    Red Hat Lightspeed (formerly Insights) for Runtimes security update
    • Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9
  • RHSA-2026:54435 Released 2026-08-12 · Red Hat rating Important
    Streams for Apache Kafka 3.2.1 release and security update
    • Streams for Apache Kafka 3.2.1
  • RHSA-2026:53806 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 security update
    • Red Hat JBoss Enterprise Application Platform 7.4.25
  • RHSA-2026:53646 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 Security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el9eap +47
  • RHSA-2026:53645 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 Security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el8eap +47
  • RHSA-2026:53644 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate
    • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el7eap +47
  • RHSA-2026:50849 Released 2026-08-05 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.5 Images Security Update
    • Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:50847 Released 2026-08-05 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.14 Images Security Update
    • Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:50846 Released 2026-08-05 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.14 Security Update
    • Red Hat build of Keycloak 26.4.14
  • RHSA-2026:50848 Released 2026-08-05 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.5 Security Update
    • Red Hat build of Keycloak 26.6.5
  • RHSA-2026:48151 Released 2026-07-29 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:48124 Released 2026-07-29 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.29.1 Release.
    • Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +2
  • RHSA-2026:48095 Released 2026-07-29 · Red Hat rating Important
    RHCS 10.8 bug fix and enhancement update
    • Red Hat Certificate System 10.8 for RHEL 8 jss-5.9.1-2.module+el8pki+24483+db4528cf.src::redhat-pki:10, ldapjdk-5.6.0-3.module+el8pki+24228+5326976e.src::redhat-pki:10, python3-redhat-pki-11.9.2-4.module+el8pki+24565+7517ad63.noarch::redhat-pki:10 +23
  • RHSA-2026:44271 Released 2026-07-23 · Red Hat rating Important
    dogtag-pki security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) dogtag-pki-11.6.0-2.el10_0, idm-pki-acme-11.6.0-2.el10_0, idm-pki-base-11.6.0-2.el10_0 +6
  • RHSA-2026:44064 Released 2026-07-23 · Red Hat rating Important
    jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) jackson-databind-2.21.4-1.el9_6, pki-jackson-databind-2.21.4-1.el9_6
  • RHSA-2026:44066 Released 2026-07-23 · Red Hat rating Important
    pki-deps:10.6 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2026:44065 Released 2026-07-23 · Red Hat rating Important
    jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) jackson-databind-2.21.4-1.el9_4, pki-jackson-databind-2.21.4-1.el9_4
  • RHSA-2026:44061 Released 2026-07-23 · Red Hat rating Important
    pki-deps:10.6 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2026:44063 Released 2026-07-23 · Red Hat rating Important
    jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) jackson-databind-2.21.4-1.el9_2, pki-jackson-databind-2.21.4-1.el9_2
  • RHSA-2026:44062 Released 2026-07-23 · Red Hat rating Important
    pki-deps:10.6 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2026:43400 Released 2026-07-22 · Red Hat rating Important
    dogtag-pki security update
    • Red Hat Enterprise Linux AppStream (v. 10) dogtag-pki-11.9.0-4.el10_2, idm-pki-acme-11.9.0-4.el10_2, idm-pki-base-11.9.0-4.el10_2 +6
  • RHSA-2026:41951 Released 2026-07-20 · Red Hat rating Important
    Red Hat Data Grid 8.6.2 security update
    • Red Hat Data Grid 8.6.2
  • RHSA-2026:40895 Released 2026-07-16 · Red Hat rating Important
    jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream (v. 9) jackson-databind-2.21.4-1.el9_8, pki-jackson-databind-2.21.4-1.el9_8
  • RHSA-2026:36839 Released 2026-07-08 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP2)
    • Red Hat Build of Apache Camel 3.33.2.SP2 com.fasterxml.jackson.core.jackson-databind-2.21.4.redhat-00002.jar, io.micrometer.micrometer-core-1.16.6.redhat-00001.jar, org.apache.cxf.cxf-core-4.1.7.rhbac-redhat-00003.jar
  • RHSA-2026:36013 Released 2026-07-08 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.2.SP2 security update
    • Red Hat build of Quarkus 3.33.2.SP2 com.fasterxml.jackson.core.jackson-databind-2.21.4.redhat-00002.jar, io.micrometer.micrometer-core-1.16.6.redhat-00001.jar, org.keycloak.keycloak-policy-enforcer-26.0.10.redhat-00001.jar
  • RHSA-2026:36002 Released 2026-07-08 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.4.SP2 security update
    • Red Hat build of Quarkus 3.27.4.SP2 com.fasterxml.jackson.core.jackson-databind-2.21.4.redhat-00002.jar, io.micrometer.micrometer-core-1.14.7.redhat-00002.jar, org.keycloak.keycloak-policy-enforcer-26.0.10.redhat-00001.jar

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Certificate System 11AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
AMQ Clients 2026.Q3Fixed RHSA-2026:69459
Cryostat 4 on RHEL 9Fixed RHSA-2026:48151
Middleware Containers for OpenShiftFixed RHSA-2026:76134
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:60247
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:60249
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:60248
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:60239
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:60251
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:60246
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:60250
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:60252
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:60259
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:60254
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:60256
Red Hat AI Inference Server 3.2Fixed RHSA-2026:61627
Red Hat AI Inference Server 3.3Fixed RHSA-2026:68699
Red Hat AMQ Broker 7.13.6Fixed RHSA-2026:66545
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Build of Apache Camel 3.33.2.SP2Fixed RHSA-2026:36839
Red Hat Certificate System 10.8 for RHEL 8Fixed RHSA-2026:48095
Red Hat Data Grid 8.6.2Fixed RHSA-2026:41951
Red Hat Enterprise Linux AI 3.3Fixed RHSA-2026:76041, RHSA-2026:76043
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:43400
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:40895
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:44062
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:44061
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:44066
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:44063
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:44065
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:44271
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:44064
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:44062
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:44061
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:44066
Red Hat JBoss EAP 7.4 ELS for RHEL 7 ServerFixed RHSA-2026:53644
Red Hat JBoss EAP 8.1 for RHEL 10Fixed RHSA-2026:70230
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:70228
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2026:70229
Red Hat JBoss Enterprise Application Platform 7.4.25Fixed RHSA-2026:53806
Red Hat JBoss Enterprise Application Platform 8.1.8.GAFixed RHSA-2026:70277
Red Hat Lightspeed (formerly Insights) for Runtimes 1.0Fixed RHSA-2026:54440
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift Dev Spaces 3.29Fixed RHSA-2026:48124
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:63327
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:63327
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:63387
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:63386
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:63385
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2026:76128
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2026:76129
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2026:76130
Red Hat Single Sign-On 7.6.13Fixed RHSA-2026:76132
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16Fixed RHSA-2026:54622
Red Hat build of Apicurio Registry 3.3.3Fixed RHSA-2026:76637
Red Hat build of Keycloak 26.4Fixed RHSA-2026:50847
Red Hat build of Keycloak 26.4.14Fixed RHSA-2026:50846
Red Hat build of Keycloak 26.6Fixed RHSA-2026:50849
Red Hat build of Keycloak 26.6.5Fixed RHSA-2026:50848
Red Hat build of Quarkus 3.27.4.SP2Fixed RHSA-2026:36002
Red Hat build of Quarkus 3.33.2.SP2Fixed RHSA-2026:36013
Streams for Apache Kafka 3.2.1Fixed RHSA-2026:54435
Not affected: 38 products
  • Cryostat 4 on RHEL 9
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Apache Camel 3.33.2.SP2
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI 3.3
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • Red Hat JBoss Enterprise Application Platform 8.1.8.GA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Dev Spaces 3.29
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat Satellite 6
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9
  • Red Hat build of Quarkus 3.27.4.SP2
  • Red Hat build of Quarkus 3.33.2.SP2
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54512
  2. 2026-10-03 Alias added: GHSA-j3rv-43j4-c7qm
  3. 2026-10-06 Fix available: RHSA-2026:76043 · Red Hat
  4. 2026-10-06 Fix available: RHSA-2026:76041 · Red Hat
  5. 2026-10-06 Fix available: RHSA-2026:76134 · Red Hat
  6. 2026-10-06 Fix available: RHSA-2026:76132 · Red Hat
  7. 2026-10-06 Fix available: RHSA-2026:76129 · Red Hat
  8. 2026-10-06 Fix available: RHSA-2026:76130 · Red Hat
  9. 2026-10-06 Fix available: Middleware Containers for OpenShift, Red Hat Enterprise Linux AI 3.3, Red Hat Single Sign-On 7.6 for RHEL 8 +2 · Red Hat
  10. 2026-10-07 Fix available: RHSA-2026:76128 · Red Hat
  11. 2026-10-07 Fix available: Red Hat Single Sign-On 7.6 for RHEL 7 Server · Red Hat
  12. 2026-10-09 Fix available: RHSA-2026:36013 · Red Hat
  13. 2026-10-09 Fix available: RHSA-2026:36002 · Red Hat
  14. 2026-10-09 Fix available: RHSA-2026:36839 · Red Hat
  15. 2026-10-09 Fix available: RHSA-2026:76637 · Red Hat
  16. 2026-10-09 Fix available: RHSA-2026:70277 · Red Hat
  17. 2026-10-09 Fix available: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, Red Hat JBoss Enterprise Application Platform 8.1, Red Hat build of Apicurio Registry 3.3.3 +2 · Red Hat
  18. 2026-10-18 Fix available: Red Hat Build of Apache Camel 3.33.2.SP2 · Red Hat
  19. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  20. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  21. 2026-10-21 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.8.GA · Red Hat
  22. 2026-10-21 Affected versions changed · Red Hat
  23. 2026-10-24 Affected versions changed · Red Hat
  24. 2026-10-26 Affected versions changed · Red Hat
  25. 2026-10-29 Affected versions changed · Red Hat
  26. 2026-11-01 Affected versions changed · Red Hat
  27. 2026-11-04 Affected versions changed · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 1

  • TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2020-07095 FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI… CVSS 3.1CRITICAL 9.8
  • TI-2020-08560 A deserialization flaw was discovered in jackson-databind through 2.9.10.4. CVSS 3.1HIGH 8.1
  • TI-2020-07635 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between… CVSS 3.1CRITICAL 9.8
  • TI-2018-05398 FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5… CVSS 3.0CRITICAL 9.8
See all 77 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences