RHSA-2026:36002
Vulnerability from csaf_redhat - Published: 2026-07-08 14:01 - Updated: 2026-10-09 00:41Summary
Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4.SP2 security update
Severity
Important
Notes
Topic: An update is now available for Red Hat build of Quarkus.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.
Details: This release of Red Hat build of Quarkus 3.27.4.SP2 includes the following CVE fixes:
* micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests [quarkus-3.27] (CVE-2026-40984)
* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [quarkus-3.27] (CVE-2026-54512)
* jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application [quarkus-3.27] (CVE-2026-54517)
* jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass [quarkus-3.27] (CVE-2026-54518)
* jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution [quarkus-3.27] (CVE-2026-54514)
* jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified [quarkus-3.27] (CVE-2026-54515)
* jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties [quarkus-3.27] (CVE-2026-54516)
* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [quarkus-3.27] (CVE-2026-54513)
* keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison [quarkus-3.27] (CVE-2026-9800)
For more information, see the release notes page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.27.4.SP2
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.27::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-9800
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-9800
Threats
Impact
Important
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-9800
Threats
Impact
Important
A flaw was found in jackson-databind, a library used for processing JSON data. This vulnerability allows a remote attacker to force the application to perform an attacker-chosen DNS (Domain Name System) query. This occurs when untrusted JSON input containing specific network address information is processed, potentially leading to the disclosure of sensitive network configuration details.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-9800
Threats
Impact
Moderate
A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly ignored properties. This could lead to unintended changes in application data, impacting data integrity.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-9800
Threats
Impact
Moderate
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass security controls by exploiting an issue in how properties are handled when both @JsonProperty (for renaming) and @JsonIgnore (for ignoring) annotations are used. By supplying a specially crafted JSON key, an attacker can directly write to a private data field, circumventing the intended security restrictions and potentially leading to unexpected data modification.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-9800
Threats
Impact
Moderate
A flaw was found in jackson-databind. A remote attacker can exploit this vulnerability due to an issue in how active-view (@JsonView) filters are applied. Specifically, setterless collections annotated with a restricted @JsonView can be populated from attacker-controlled JSON even when the active view is configured to exclude them. This can lead to information disclosure, allowing an attacker to access data that should otherwise be restricted.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-9800
Threats
Impact
Moderate
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass security view restrictions by sending specially crafted JSON (JavaScript Object Notation) data. The UnwrappedPropertyHandler component, which processes unwrapped properties, incorrectly populates constructor parameters that should be hidden by an active security view. This can lead to unauthorized information disclosure or data manipulation.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-9800
Threats
Impact
Moderate
References
75 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat build of Quarkus 3.27.4.SP2 includes the following CVE fixes:\n\n* micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests [quarkus-3.27] (CVE-2026-40984)\n\n* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [quarkus-3.27] (CVE-2026-54512)\n\n* jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application [quarkus-3.27] (CVE-2026-54517)\n\n* jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass [quarkus-3.27] (CVE-2026-54518)\n\n* jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution [quarkus-3.27] (CVE-2026-54514)\n\n* jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified [quarkus-3.27] (CVE-2026-54515)\n\n* jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties [quarkus-3.27] (CVE-2026-54516)\n\n* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [quarkus-3.27] (CVE-2026-54513)\n\n* keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison [quarkus-3.27] (CVE-2026-9800)\n\nFor more information, see the release notes page listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:36002",
"url": "https://access.redhat.com/errata/RHSA-2026:36002"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/products/quarkus/",
"url": "https://access.redhat.com/products/quarkus/"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.4.SP2",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.4.SP2"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27",
"url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27"
},
{
"category": "external",
"summary": "QUARKUS-8308",
"url": "https://issues.redhat.com/browse/QUARKUS-8308"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36002.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4.SP2 security update",
"tracking": {
"current_release_date": "2026-10-09T00:41:06+00:00",
"generator": {
"date": "2026-10-09T00:41:06+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:36002",
"initial_release_date": "2026-07-08T14:01:45+00:00",
"revision_history": [
{
"date": "2026-07-08T14:01:45+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-08T14:01:45+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-09T00:41:06+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Quarkus 3.27.4.SP2",
"product": {
"name": "Red Hat build of Quarkus 3.27.4.SP2",
"product_id": "Red Hat build of Quarkus 3.27.4.SP2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quarkus:3.27::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Quarkus"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Bas Levering"
]
}
],
"cve": "CVE-2026-9800",
"cwe": {
"id": "CWE-1025",
"name": "Comparison Using Wrong Factors"
},
"discovery_date": "2026-05-28T03:57:56.111000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482472"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9800"
},
{
"category": "external",
"summary": "RHBZ#2482472",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482472"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9800"
}
],
"release_date": "2026-05-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T14:01:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36002"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison"
},
{
"cve": "CVE-2026-40984",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-09T05:01:51.700197+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2486716"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service (DoS) condition. This vulnerability allows an attacker to disrupt the availability of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service vulnerability in Micrometer, a component present in several Red Hat products. A remote, unauthenticated attacker can exploit this flaw by sending specially crafted HTTP requests, leading to resource exhaustion and disrupting the availability of affected services. Exploitation of this flaw requires one or more HTTP server instrumentation(s), from one of the vulnerable components, to be configured to record metrics.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40984"
},
{
"category": "external",
"summary": "RHBZ#2486716",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486716"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40984",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40984"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40984",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40984"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-40984",
"url": "https://spring.io/security/cve-2026-40984"
}
],
"release_date": "2026-06-09T03:47:46.447000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T14:01:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36002"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T14:01:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36002"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-54513",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2026-06-23T22:01:34.437620+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492010"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in `jackson-databind` allows for a security bypass, enabling arbitrary code execution. The vulnerability arises from insufficient validation of array component types by `BasicPolymorphicTypeValidator`, which permits deserialization of unallowlisted types when processing untrusted input. This bypass of type validation can lead to a complete system compromise, affecting confidentiality, integrity, and availability in Red Hat products utilizing `jackson-databind` for data processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54513"
},
{
"category": "external",
"summary": "RHBZ#2492010",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54513"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5",
"url": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e",
"url": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5981",
"url": "https://github.com/FasterXML/jackson-databind/issues/5981"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5983",
"url": "https://github.com/FasterXML/jackson-databind/issues/5983"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/pull/5984",
"url": "https://github.com/FasterXML/jackson-databind/pull/5984"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f"
}
],
"release_date": "2026-06-23T20:53:52.543000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T14:01:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36002"
},
{
"category": "workaround",
"details": "Upgrade to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the application\u2019s ObjectMapper configuration to eliminate the affected deserialization path. Rebuild and restart the application to apply the configuration change.\n\nAs an additional mitigation, disable polymorphic deserialization of untrusted data where possible by avoiding or removing default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is required, restrict allowed subtypes using a strict whitelist of trusted application packages and avoid broad or permissive type validation rules.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution"
},
{
"cve": "CVE-2026-54514",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:16.736732+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492004"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a library used for processing JSON data. This vulnerability allows a remote attacker to force the application to perform an attacker-chosen DNS (Domain Name System) query. This occurs when untrusted JSON input containing specific network address information is processed, potentially leading to the disclosure of sensitive network configuration details.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: A flaw in `jackson-databind` can lead to information disclosure in Red Hat products that process untrusted JSON input. By crafting malicious JSON containing `InetSocketAddress` fields, a remote attacker can force the application to perform arbitrary DNS queries. This eager DNS resolution occurs before application-level validation, potentially revealing internal network configuration details through DNS logs.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54514"
},
{
"category": "external",
"summary": "RHBZ#2492004",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492004"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54514"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4",
"url": "https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/pull/5951",
"url": "https://github.com/FasterXML/jackson-databind/pull/5951"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5"
}
],
"release_date": "2026-06-23T20:51:50.612000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T14:01:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36002"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution"
},
{
"cve": "CVE-2026-54515",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-23T22:01:52.824092+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492016"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly ignored properties. This could lead to unintended changes in application data, impacting data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a Moderate impact flaw in jackson-databind where applications enabling case-insensitive property matching alongside per-property @JsonIgnoreProperties may inadvertently expose fields to unauthorized modification. This bypass of intended property exclusions could lead to data integrity issues within affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54515"
},
{
"category": "external",
"summary": "RHBZ#2492016",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492016"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54515"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa",
"url": "https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5962",
"url": "https://github.com/FasterXML/jackson-databind/issues/5962"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5964",
"url": "https://github.com/FasterXML/jackson-databind/issues/5964"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"
}
],
"release_date": "2026-06-23T20:50:25.715000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T14:01:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36002"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified"
},
{
"cve": "CVE-2026-54516",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-23T22:00:52.237533+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491996"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass security controls by exploiting an issue in how properties are handled when both @JsonProperty (for renaming) and @JsonIgnore (for ignoring) annotations are used. By supplying a specially crafted JSON key, an attacker can directly write to a private data field, circumventing the intended security restrictions and potentially leading to unexpected data modification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: This flaw in jackson-databind allows for property tampering and mass assignment in Red Hat products. When `MapperFeature.INFER_PROPERTY_MUTATORS` is enabled by default, an attacker can bypass `@JsonIgnore` annotations on setters by supplying a renamed JSON key, directly writing to private backing fields and circumventing intended security controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54516"
},
{
"category": "external",
"summary": "RHBZ#2491996",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491996"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54516",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54516"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54516",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54516"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a",
"url": "https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af",
"url": "https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/pull/5967",
"url": "https://github.com/FasterXML/jackson-databind/pull/5967"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/pull/5968",
"url": "https://github.com/FasterXML/jackson-databind/pull/5968"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55"
}
],
"release_date": "2026-06-23T20:48:52.730000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T14:01:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36002"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties"
},
{
"cve": "CVE-2026-54517",
"cwe": {
"id": "CWE-1220",
"name": "Insufficient Granularity of Access Control"
},
"discovery_date": "2026-06-23T22:01:10.783814+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492002"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. A remote attacker can exploit this vulnerability due to an issue in how active-view (@JsonView) filters are applied. Specifically, setterless collections annotated with a restricted @JsonView can be populated from attacker-controlled JSON even when the active view is configured to exclude them. This can lead to information disclosure, allowing an attacker to access data that should otherwise be restricted.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: A flaw in jackson-databind allows for information disclosure and an access-control bypass. This occurs because the `@JsonView` filter, intended to restrict data visibility, is not correctly applied to setterless collection and map properties during deserialization. An attacker could exploit this to populate view-restricted properties from untrusted JSON, potentially accessing sensitive data that should be excluded by the active view.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54517"
},
{
"category": "external",
"summary": "RHBZ#2492002",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492002"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54517",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54517"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54517",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54517"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/5bf23edb4221f7dd2ec8e71ff6d26c61640f261d",
"url": "https://github.com/FasterXML/jackson-databind/commit/5bf23edb4221f7dd2ec8e71ff6d26c61640f261d"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/94c5d215b3af1505098c686405d9641f041a9962",
"url": "https://github.com/FasterXML/jackson-databind/commit/94c5d215b3af1505098c686405d9641f041a9962"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/pull/5969",
"url": "https://github.com/FasterXML/jackson-databind/pull/5969"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/pull/5970",
"url": "https://github.com/FasterXML/jackson-databind/pull/5970"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38"
}
],
"release_date": "2026-06-23T20:47:22.977000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T14:01:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36002"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application"
},
{
"cve": "CVE-2026-54518",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"discovery_date": "2026-06-23T22:01:46.516642+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492014"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass security view restrictions by sending specially crafted JSON (JavaScript Object Notation) data. The UnwrappedPropertyHandler component, which processes unwrapped properties, incorrectly populates constructor parameters that should be hidden by an active security view. This can lead to unauthorized information disclosure or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate vulnerability in jackson-databind allows a remote attacker to bypass security view restrictions. When processing unwrapped creator properties, the component fails to properly enforce @JsonView annotations, enabling sensitive constructor parameters to be populated from untrusted JSON data. This could lead to unauthorized information disclosure or data manipulation in applications utilizing specific jackson-databind configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54518"
},
{
"category": "external",
"summary": "RHBZ#2492014",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492014"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54518",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54518"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54518",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54518"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/721fa07ebbd4aab4a659a1a68940878315c3e341",
"url": "https://github.com/FasterXML/jackson-databind/commit/721fa07ebbd4aab4a659a1a68940878315c3e341"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/d633bc038f200c1397c07f1a2b46f58e72c91eea",
"url": "https://github.com/FasterXML/jackson-databind/commit/d633bc038f200c1397c07f1a2b46f58e72c91eea"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/pull/5971",
"url": "https://github.com/FasterXML/jackson-databind/pull/5971"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/pull/5973",
"url": "https://github.com/FasterXML/jackson-databind/pull/5973"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rcqc-6cw3-h962",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rcqc-6cw3-h962"
}
],
"release_date": "2026-06-23T21:02:07.539000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T14:01:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36002"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4.SP2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…