| jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54514 · GHSA-HGJ6-7826-R7M5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerabilityCVE-2026-49432 · GHSA-XJWQ-9JW5-JF7W |
org.apache.activemq:activemq-allorg.apache.activemq:activemq-stomp |
MavenRed Hat |
High
|
Fix reported |
|
| Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerabilityCVE-2026-53917 · GHSA-F77W-PX59-CQF5 |
org.apache.activemq:activemq-allorg.apache.activemq:activemq-broker |
MavenRed Hat |
High
|
Fix reported |
|
| Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerabilityCVE-2026-49434 · GHSA-H5GM-RVW6-2XPX |
org.apache.activemq:activemq-allorg.apache.activemq:activemq-broker |
MavenRed Hat |
High
|
Fix reported |
|
| MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticingCVE-2026-119281 · GHSA-GRFQ-R75J-RW9X |
org.mariadb.jdbc:mariadb-java-clientRed Hat Build of Keycloak/mariadb-java-client |
MavenRed Hat |
Medium
|
Fix reported |
|
| MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packetsCVE-2026-119276 · GHSA-H599-M3W5-9M7X |
org.mariadb.jdbc:mariadb-java-clientRed Hat Build of Keycloak/mariadb-java-client |
MavenRed Hat |
Medium
|
Fix reported |
|
| MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client filesCVE-2026-119210 · GHSA-FHX5-2XQW-2CGM |
org.mariadb.jdbc:mariadb-java-clientRed Hat Build of Keycloak/mariadb-java-client |
MavenRed Hat |
Medium
|
Fix reported |
|
| MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsCVE-2026-119279 · GHSA-797X-P4MC-JWPM |
org.mariadb.jdbc:mariadb-java-clientRed Hat Build of Keycloak/mariadb-java-client |
MavenRed Hat |
Medium
|
Fix reported |
|
| MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengthsCVE-2026-119280 · GHSA-4JQ2-8V3C-97W8 |
org.mariadb.jdbc:mariadb-java-clientRed Hat Build of Keycloak/mariadb-java-client |
MavenRed Hat |
Low
|
Fix reported |
|
| jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output ContextCVE-2026-55858 · GHSA-XVR9-35CR-46V9 |
org.mariadb.jdbc:mariadb-java-clientOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX AddressCVE-2026-59919 · GHSA-WH89-7897-X99H |
io.netty:netty-codec-haproxyCryostat 4/netty-codec-haproxy |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validationCVE-2026-59898 · GHSA-4MP9-239F-G9HG |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyCVE-2026-59888 · GHSA-3PJW-73GF-8QR5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesCVE-2026-54515 · GHSA-5JMJ-H7XM-6Q6V |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind has @JsonView bypass for setterless creator propertiesCVE-2026-54517 · GHSA-5HH8-Q8HV-FR38 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsingCVE-2026-42580 · GHSA-M4CV-J2PX-7723 |
io.netty:netty-codec-httpCryostat 4/netty-codec-http2 |
MavenRed Hat |
Medium
|
Fix reported |
|
