| jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54514 · GHSA-HGJ6-7826-R7M5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Bouncy Castle has an LDAP injectionCVE-2026-0636 · GHSA-C3FC-8QFF-9HWX |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15to18 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiationCVE-2026-54512 · GHSA-J3RV-43J4-C7QM |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local userCVE-2026-106451 · GHSA-MCR4-QMVW-PX4G |
at.yawk.lz4:lz4-javaorg.lz4:lz4-java |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputsCVE-2026-106450 · GHSA-GM45-99XC-R7WV |
at.yawk.lz4:lz4-javaorg.lz4:lz4-java |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryErrorCVE-2026-106453 · GHSA-6CX8-RJF8-PR8G |
at.yawk.lz4:lz4-javaorg.lz4:lz4-java |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream headerCVE-2026-106452 · GHSA-4V53-57PG-C464 |
at.yawk.lz4:lz4-javaorg.lz4:lz4-java |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarationsCVE-2026-75140 · GHSA-65R4-943X-97JJ |
org.jsoup:jsoupExploit Intelligence/exploit-intelligence/agent-client-rhel9 |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)CVE-2026-68494 · GHSA-R7WM-3CXJ-WFF9 |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()CVE-2026-89407 · GHSA-P6PP-M3F8-5C89 |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)CVE-2026-89425 · GHSA-7HHH-6RMP-J9QF |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-databind quadratic forward-reference completion CVE-2026-91777 · GHSA-CXP5-3PX4-PW24 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoSCVE-2026-68497 · GHSA-Q4XH-88C3-WMH7 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLsCVE-2026-57285 · GHSA-G7C6-WXJF-8564 |
org.jenkins-ci.plugins:github-branch-sourceOpenShift Developer Tools and Services/jenkins-2-plugins |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Jenkins Pipeline: Groovy Plugin has a CSRF vulnerabilityCVE-2026-57283 · GHSA-72C8-3WWG-R59W |
io.jenkins.plugins:pipeline-groovy-libOpenShift Developer Tools and Services/jenkins-2-plugins |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Jenkins Script Security Plugin has a script security bypass vulnerabilityCVE-2026-57281 · GHSA-CFJ9-2VGR-HPXP |
org.jenkins-ci.plugins:script-securityOpenShift Developer Tools and Services/jenkins-2-plugins |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
