| jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54514 · GHSA-HGJ6-7826-R7M5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWriteCVE-2026-116590 · GHSA-XQRX-QH46-34M7 |
org.xerial.snappy:snappy-javaOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methodsCVE-2026-93451 · GHSA-GWQ9-9FFJ-MVRV |
org.xerial.snappy:snappy-javaRed Hat Ceph Storage 8/liborc |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Requests vulnerable to .netrc credentials leak via malicious URLsCVE-2024-47081 · GHSA-9HJG-9R4M-MVJ7بازه‌ها نیاز به بررسی دارند. |
requestsAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoSCVE-2026-68497 · GHSA-Q4XH-88C3-WMH7 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Eclipse Jetty: Path parameter traversalCVE-2026-8384 · GHSA-W7X5-G22V-XQHR |
org.eclipse.jetty:jetty-utilOpenShift Developer Tools and Services/jenkins |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Eclipse Jetty: HTTP Authority/Host mismatchCVE-2026-6790 · GHSA-7P3P-8QV8-M2VH |
org.eclipse.jetty:jetty-serverOpenShift Developer Tools and Services/jenkins |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyCVE-2026-59888 · GHSA-3PJW-73GF-8QR5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesCVE-2026-54515 · GHSA-5JMJ-H7XM-6Q6V |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has @JsonView bypass for setterless creator propertiesCVE-2026-54517 · GHSA-5HH8-Q8HV-FR38 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serializationCVE-2026-49844 · GHSA-QV9R-C865-CP47 |
org.apache.logging.log4j:log4j-apiCryostat 4/log4j-api |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has a @JsonView bypass for unwrapped creator parametersCVE-2026-54518 · GHSA-RCQC-6CW3-H962 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fieldsCVE-2026-54516 · GHSA-9FXM-VC8V-HJ55 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty epoll transport denial of service via RST on half-closed TCP connectionCVE-2026-42577 · GHSA-RWM7-X88C-3G2P |
io.netty:netty-transport-classes-epollCryostat 4/cryostat/cryostat-rhel9 |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| tar-rs `unpack_in` can chmod arbitrary directories by following symlinksCVE-2026-33056 · GHSA-J4XF-2G29-59PHبازه‌ها نیاز به بررسی دارند. |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9 |
Rust / CargoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
