| jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54514 · GHSA-HGJ6-7826-R7M5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)CVE-2026-68494 · GHSA-R7WM-3CXJ-WFF9 |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()CVE-2026-89407 · GHSA-P6PP-M3F8-5C89 |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)CVE-2026-89425 · GHSA-7HHH-6RMP-J9QF |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoSCVE-2026-68497 · GHSA-Q4XH-88C3-WMH7 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyCVE-2026-59888 · GHSA-3PJW-73GF-8QR5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesCVE-2026-54515 · GHSA-5JMJ-H7XM-6Q6V |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has @JsonView bypass for setterless creator propertiesCVE-2026-54517 · GHSA-5HH8-Q8HV-FR38 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()CVE-2026-50193 · GHSA-3WRR-7QPF-2PRH |
com.fasterxml.jackson.core:jackson-databindOpenShift Developer Tools and Services/jenkins-2-plugins |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has a @JsonView bypass for unwrapped creator parametersCVE-2026-54518 · GHSA-RCQC-6CW3-H962 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fieldsCVE-2026-54516 · GHSA-9FXM-VC8V-HJ55 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputsCVE-2025-48924 · GHSA-J288-Q9X7-2F5V |
commons-lang:commons-langorg.apache.commons:commons-lang3 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Apache Tomcat Session Fixation vulnerabilityCVE-2025-55668 · GHSA-23HV-MWM6-G8JF |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Apache Tomcat Vulnerable to Improper Resource Shutdown or ReleaseCVE-2025-61795 · GHSA-HGRR-935X-PQ79 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
کم
|
اصلاح گزارش شده |
|
| Apache Tomcat Vulnerable to Relative Path TraversalCVE-2025-55752 · GHSA-WMWF-9CCG-FFF5 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| dogtag-pki: pki-core: redhat-pki: pki: ACME admin enable/disable endpoint authentication bypass via trailing slashCVE-2026-18047 |
Red Hat Certificate System 10/redhat-pki:10/redhat-pkiRed Hat Certificate System 11/redhat-pki |
Red Hat |
متوسط
|
اصلاح اعلام نشده |
|
