Skip to content
OpenAdvisories
High ELSA-2026-43400 2 CVEs

Important: dogtag-pki security update (Oracle Linux 10)

Published Jul 23, 2026 · Updated Jul 23, 2026

Ecosystem: Oracle Linux

Summary

[11.9.0-4.0.1]
- Treat Oracle Linux the same as RHEL when selecting the Tomcat app server version.

[11.9.0-4]
- Update jackson bundled to 2.21.4
- Resolves: RHEL-188290
- Resolves: RHEL-190906

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 10 idm-pki-acme 0:11.9.0-4.0.1.el10_2
Oracle Linux · 10 idm-pki-base 0:11.9.0-4.0.1.el10_2
Oracle Linux · 10 idm-pki-ca 0:11.9.0-4.0.1.el10_2
Oracle Linux · 10 idm-pki-java 0:11.9.0-4.0.1.el10_2
Oracle Linux · 10 idm-pki-kra 0:11.9.0-4.0.1.el10_2
Oracle Linux · 10 idm-pki-server 0:11.9.0-4.0.1.el10_2
Oracle Linux · 10 idm-pki-tools 0:11.9.0-4.0.1.el10_2
Oracle Linux · 10 python3-idm-pki 0:11.9.0-4.0.1.el10_2

Vulnerabilities 2

  • High 8.1
    CVE-2026-54512 Public exploit

    jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.1
    CVE-2026-54513

    jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven