Skip to content
OpenAdvisories
High ALSA-2026:40895 2 CVEs

Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

Published Jul 16, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.

Security Fix(es):

* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)
* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 6

ReleasePackageFixed in
AlmaLinux · 9 pki-jackson-annotations 2.21-1.el9_8
AlmaLinux · 9 pki-jackson-core 2.21.4-1.el9_8
AlmaLinux · 9 pki-jackson-databind 2.21.4-1.el9_8
AlmaLinux · 9 pki-jackson-jaxrs-json-provider 2.21.4-1.el9_8
AlmaLinux · 9 pki-jackson-jaxrs-providers 2.21.4-1.el9_8
AlmaLinux · 9 pki-jackson-module-jaxb-annotations 2.21.4-1.el9_8

Vulnerabilities 2

  • High 8.1
    CVE-2026-54512 Public exploit

    jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.1
    CVE-2026-54513

    jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-54512
  • report
    https://access.redhat.com/security/cve/CVE-2026-54513
  • report
    https://bugzilla.redhat.com/2492010
  • report
    https://bugzilla.redhat.com/2492015
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-40895.html