Summary
jackson-annotations
[2.21-1]
- Update to version 2.21
- Resolves: RHEL-188300
jackson-core
[2.21.4-1]
- Update to version 2.21.4
- Resolves: RHEL-188300
jackson-databind
[2.21.4-1]
- Update to version 2.21.4
- Resolves: RHEL-188300
jackson-jaxrs-providers
[2.21.4-1]
- Update to version 2.21.4
- Resolves: RHEL-190937
jackson-modules-base
[2.21.4-1]
- Update to version 2.21.4
- Resolves: RHEL-190947
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | pki-jackson-annotations | 0:2.21-1.el9_8 |
| Oracle Linux · 9 | pki-jackson-core | 0:2.21.4-1.el9_8 |
| Oracle Linux · 9 | pki-jackson-databind | 0:2.21.4-1.el9_8 |
| Oracle Linux · 9 | pki-jackson-jaxrs-json-provider | 0:2.21.4-1.el9_8 |
| Oracle Linux · 9 | pki-jackson-jaxrs-providers | 0:2.21.4-1.el9_8 |
| Oracle Linux · 9 | pki-jackson-module-jaxb-annotations | 0:2.21.4-1.el9_8 |
Vulnerabilities 2
-
High 8.1CVE-2026-54512 Public exploit
jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…
-
High 8.1
jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only…