Skip to content
OpenAdvisories
High ELSA-2026-77648 1 CVE

Important: dogtag-pki security update (Oracle Linux 10)

Published Oct 8, 2026 · Updated Oct 8, 2026

Ecosystem: Oracle Linux

Summary

[11.9.0-6.0.1]
- Treat Oracle Linux the same as RHEL when selecting the Tomcat app server version.

[11.9.0-8]
- Update jackson bundled to 2.21.6
- Resolves: RHEL-259220

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 10 idm-pki-acme 0:11.9.0-6.0.1.el10_2
Oracle Linux · 10 idm-pki-base 0:11.9.0-6.0.1.el10_2
Oracle Linux · 10 idm-pki-ca 0:11.9.0-6.0.1.el10_2
Oracle Linux · 10 idm-pki-java 0:11.9.0-6.0.1.el10_2
Oracle Linux · 10 idm-pki-kra 0:11.9.0-6.0.1.el10_2
Oracle Linux · 10 idm-pki-server 0:11.9.0-6.0.1.el10_2
Oracle Linux · 10 idm-pki-tools 0:11.9.0-6.0.1.el10_2
Oracle Linux · 10 python3-idm-pki 0:11.9.0-6.0.1.el10_2

Vulnerabilities 1

  • High 7.5
    CVE-2026-68497

    jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service

    jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._dese…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven