| jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiationCVE-2026-54512 · GHSA-J3RV-43J4-C7QM |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
High
|
Fix reported |
|
| snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWriteCVE-2026-116590 · GHSA-XQRX-QH46-34M7 |
org.xerial.snappy:snappy-javaOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methodsCVE-2026-93451 · GHSA-GWQ9-9FFJ-MVRV |
org.xerial.snappy:snappy-javaRed Hat Ceph Storage 8/liborc |
MavenRed Hat |
High
|
Fix reported |
|
| snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengthaCVE-2026-108106 · GHSA-Q233-G92Q-QXP6 |
org.xerial.snappy:snappy-javaRed Hat Ceph Storage 7/liborc |
MavenRed Hat |
High
|
Fix reported |
|
| Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocationCVE-2026-102554 · GHSA-XXPH-C9WW-HJ94 |
com.google.guava:guavaExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Spark History Server allows stored cross-site scripting through unescaped application namesCVE-2026-32773 · GHSA-9437-39HJ-3C93Version ranges need review. |
org.apache.spark:spark-core_2.12org.apache.spark:spark-core_2.13 |
MavenPyPIRed Hat |
Medium
|
Fix reported |
|
| jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)CVE-2026-68494 · GHSA-R7WM-3CXJ-WFF9 |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()CVE-2026-89407 · GHSA-P6PP-M3F8-5C89 |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)CVE-2026-89425 · GHSA-7HHH-6RMP-J9QF |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoSCVE-2026-68497 · GHSA-Q4XH-88C3-WMH7 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header OverwriteCVE-2026-59903 · GHSA-8C42-7QJ2-3J46 |
io.netty:netty-codec-httpExploit Intelligence/exploit-intelligence/agent-client-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| bouncycastle: Bouncy Castle: Denial of Service via untrusted keystore length allocationCVE-2026-12185 |
OpenShift Developer Tools and Services/jenkins-2-pluginsOpenShift Developer Tools and Services/jenkins |
Red Hat |
Medium
|
No fix reported |
|
| com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of serviceCVE-2026-87795 |
Exploit Intelligence/exploit-intelligence/agent-client-rhel9OpenShift Developer Tools and Services/jenkins-2-plugins |
Red Hat |
High
|
No fix reported |
|
| com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirectCVE-2026-87824 |
Exploit Intelligence/exploit-intelligence/agent-client-rhel9OpenShift Developer Tools and Services/jenkins-2-plugins |
Red Hat |
High
|
No fix reported |
|
| zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds readCVE-2026-89046 |
Exploit Intelligence/exploit-intelligence/agent-client-rhel9OpenShift Developer Tools and Services/jenkins-2-plugins |
Red Hat |
High
|
No fix reported |
|
| com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompressCVE-2026-90560 |
Exploit Intelligence/exploit-intelligence/agent-client-rhel9OpenShift Developer Tools and Services/jenkins-2-plugins |
Red Hat |
High
|
No fix reported |
|
