Security
فارسی
All products

Red Hat Certificate System 11/redhat-pki

Red Hat · Package
17 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiationCVE-2026-54512 · GHSA-J3RV-43J4-C7QM com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat High Fix reported
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)CVE-2026-68494 · GHSA-R7WM-3CXJ-WFF9 com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core MavenRed Hat High Fix reported
jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()CVE-2026-89407 · GHSA-P6PP-M3F8-5C89 com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core MavenRed Hat High Fix reported
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)CVE-2026-89425 · GHSA-7HHH-6RMP-J9QF com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core MavenRed Hat High Fix reported
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoSCVE-2026-68497 · GHSA-Q4XH-88C3-WMH7 com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat High Fix reported
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyCVE-2026-59888 · GHSA-3PJW-73GF-8QR5 com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS ConditionCVE-2026-18401 · GHSA-72HV-8253-57QQ com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core MavenRed Hat Medium Fix reported
pki-core: dogtag-pki: redhat-pki: pki-core: CA renewal request processing omits realm authorization check performed by enrollment pathCVE-2026-17039 Red Hat Certificate System 10/redhat-pkiRed Hat Certificate System 11/redhat-pki Red Hat Low No fix reported
dogtag-pki: pki-core: redhat-pki: pki: ACME admin enable/disable endpoint authentication bypass via trailing slashCVE-2026-18047 Red Hat Certificate System 10/redhat-pki:10/redhat-pkiRed Hat Certificate System 11/redhat-pki Red Hat Medium No fix reported
dogtag-pki: pki-core: redhat-pki: pki: ACME HTTP-01 validation SSRF via IP literal identifiers and unvalidated redirectsCVE-2026-18369 Red Hat Certificate System 10/redhat-pki:10/redhat-pkiRed Hat Certificate System 11/redhat-pki Red Hat Medium No fix reported
resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard ConfigCVE-2026-89058 Red Hat Build of Keycloak/resteasy-coreRed Hat Build of Keycloak/rhbk/keycloak-rhel9-operator Red Hat Medium No fix reported
resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS)CVE-2026-89059 Red Hat Build of Keycloak/resteasy-coreRed Hat Build of Keycloak/rhbk/keycloak-rhel9-operator Red Hat High No fix reported
pki-core: dogtag-pki: redhat-pki: pki: EST fullcmc authentication bypass allows certificate mis-issuance with arbitrary subjectCVE-2026-104988 Red Hat Certificate System 10/redhat-pki:10/redhat-pkiRed Hat Certificate System 11/redhat-pki Red Hat High No fix reported