This security update addresses two critical vulnerabilities (CVE-2026-54512 and CVE-2026-54513, both CVSS 8.1 HIGH) in the Jackson-databind library, which allow arbitrary code execution via a bypass of the PolymorphicTypeValidator security mechanism. Affected versions are fasterxml jackson-databind 2.10.0 to <2.18.8, 2.19.0 to <2.21.4, and 3.0.0 to <3.1.4. The vulnerabilities are fixed in versions 2.18.8, 2.21.4, and 3.1.4, respectively.
Red Hat Product Errata RHSA-2026:44064 - Security Advisory Issued: 2026-07-23 Updated: 2026-07-23 RHSA-2026:44064 - Security Advisory Overview Updated Packages Synopsis Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for multiple packages is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fix(es): jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 Red Hat Enterprise Linux Server - AUS 9.6 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x Fixes BZ - 2492010 - CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution BZ - 2492015 - CVE-2026-54512 jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass CVEs CVE-2026-54512 CVE-2026-54513 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 SRPM jackson-annotations-2.21-1.el9_6.src.rpm SHA-256: d16b0fb0c7b8a11ed4a0fd005780b65e5689adb74e88fdb161da69c96af3c2df jackson-core-2.21.4-1.el9_6.src.rpm SHA-256: d71a6cb9287ecc5a683a5bf07ad94bad65e376cdab82b2859e44575503072c00 jackson-databind-2.21.4-1.el9_6.src.rpm SHA-256: a1da8e770b4123fe6cfcd579925b2bbed779db1372351fa83a09f9397d73d69c jackson-jaxrs-providers-2.21.4-1.el9_6.src.rpm SHA-256: 8be44fc4638b373edd93b34526e0255d5ccd56eb1934c8d399a20fe0ac08dc61 jackson-modules-base-2.21.4-1.el9_6.src.rpm SHA-256: 57677f53e52ec378807f517afc95d94761e296315df6f3fd4ef2c3093f96ed3e x86_64 pki-jackson-annotations-2.21-1.el9_6.noarch.rpm SHA-256: 11e459f7e85daa60cfcdd105b4e360f4ee86f4fa66878fd12221a3f710e65598 pki-jackson-core-2.21.4-1.el9_6.noarch.rpm SHA-256: bd533970179fbd6d59b20e4f9c7a50de9abf66d9a8662c4161cc8e6e917c4558 pki-jackson-databind-2.21.4-1.el9_6.noarch.rpm SHA-256: fee35bf717a1b4ad11f6a90f7b626f9e33417e500758f21f3ac45a4efc787e36 pki-jackson-jaxrs-json-provider-2.21.4-1.el9_6.noarch.rpm SHA-256: 2385d84d19b996e0afbe18b20716f8b72acc81c3817de4616a9a001df875f9e3 pki-jackson-jaxrs-providers-2.21.4-1.el9_6.noarch.rpm SHA-256: 59d567b1fb06c0504e6e7c61732176163fc715e9aed26f34c655a8f7ab08779f pki-jackson-module-jaxb-annotations-2.21.4-1.el9_6.noarch.rpm SHA-256: 3916fad43dae7cc271cbcbc1bb0870895afc170ca89ccd02182b969165768662 Red Hat Enterprise Linux Server - AUS 9.6 SRPM jackson-annotations-2.21-1.el9_6.src.rpm SHA-256: d16b0fb0c7b8a11ed4a0fd005780b65e5689adb74e88fdb161da69c96af3c2df jackson-core-2.21.4-1.el9_6.src.rpm SHA-256: d71a6cb9287ecc5a683a5bf07ad94bad65e376cdab82b2859e44575503072c00 jackson-databind-2.21.4-1.el9_6.src.rpm SHA-256: a1da8e770b4123fe6cfcd579925b2bbed779db1372351fa83a09f9397d73d69c jackson-jaxrs-providers-2.21.4-1.el9_6.src.rpm SHA-256: 8be44fc4638b373edd93b34526e0255d5ccd56eb1934c8d399a20fe0ac08dc61 jackson-modules-base-2.21.4-1.el9_6.src.rpm SHA-256: 57677f53e52ec378807f517afc95d94761e296315df6f3fd4ef2c3093f96ed3e x86_64 pki-jackson-annotations-2.21-1.el9_6.noarch.rpm SHA-256: 11e459f7e85daa60cfcdd105b4e360f4ee86f4fa66878fd12221a3f710e65598 pki-jackson-core-2.21.4-1.el9_6.noarch.rpm SHA-256: bd533970179fbd6d59b20e4f9c7a50de9abf66d9a8662c4161cc8e6e917c4558 pki-jackson-databind-2.21.4-1.el9_6.noarch.rpm SHA-256: fee35bf717a1b4ad11f6a90f7b626f9e33417e500758f21f3ac45a4efc787e36 pki-jackson-jaxrs-json-provider-2.21.4-1.el9_6.noarch.rpm SHA-256: 2385d84d19b996e0afbe18b20716f8b72acc81c3817de4616a9a001df875f9e3 pki-jackson-jaxrs-providers-2.21.4-1.el9_6.noarch.rpm SHA-256: 59d567b1fb06c0504e6e7c61732176163fc715e9aed26f34c655a8f7ab08779f pki-jackson-module-jaxb-annotations-2.21.4-1.el9_6.noarch.rpm SHA-256: 3916fad43dae7cc271cbcbc1bb0870895afc170ca89ccd02182b969165768662 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 SRPM jackson-annotations-2.21-1.el9_6.src.rpm SHA-256: d16b0fb0c7b8a11ed4a0fd005780b65e5689adb74e88fdb161da69c96af3c2df jackson-core-2.21.4-1.el9_6.src.rpm SHA-256: d71a6cb9287ecc5a683a5bf07ad94bad65e376cdab82b2859e44575503072c00 jackson-databind-2.21.4-1.el9_6.src.rpm SHA-256: a1da8e770b4123fe6cfcd579925b2bbed779db1372351fa83a09f9397d73d69c jackson-jaxrs-providers-2.21.4-1.el9_6.src.rpm SHA-256: 8be44fc4638b373edd93b34526e0255d5ccd56eb1934c8d399a20fe0ac08dc61 jackson-modules-base-2.21.4-1.el9_6.src.rpm SHA-256: 57677f53e52ec378807f517afc95d94761e296315df6f3fd4ef2c3093f96ed3e s390x pki-jackson-annotations-2.21-1.el9_6.noarch.rpm SHA-256: 11e459f7e85daa60cfcdd105b4e360f4ee86f4fa66878fd12221a3f710e65598 pki-jackson-core-2.21.4-1.el9_6.noarch.rpm SHA-256: bd533970179fbd6d59b20e4f9c7a50de9abf66d9a8662c4161cc8e6e917c4558 pki-jackson-databind-2.21.4-1.el9_6.noarch.rpm SHA-256: fee35bf717a1b4ad11f6a90f7b626f9e33417e500758f21f3ac45a4efc787e36 pki-jackson-jaxrs-json-provider-2.21.4-1.el9_6.noarch.rpm SHA-256: 2385d84d19b996e0afbe18b20716f8b72acc81c3817de4616a9a001df875f9e3 pki-jackson-jaxrs-providers-2.21.4-1.el9_6.noarch.rpm SHA-256: 59d567b1fb06c0504e6e7c61732176163fc715e9aed26f34c655a8f7ab08779f pki-jackson-module-jaxb-annotations-2.21.4-1.el9_6.noarch.rpm SHA-256: 3916fad43dae7cc271cbcbc1bb0870895afc170ca89ccd02182b969165768662 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 SRPM jackson-annotations-2.21-1.el9_6.src.rpm SHA-256: d16b0fb0c7b8a11ed4a0fd005780b65e5689adb74e88fdb161da69c96af3c2df jackson-core-2.21.4-1.el9_6.src.rpm SHA-256: d71a6cb9287ecc5a683a5bf07ad94bad65e376cdab82b2859e44575503072c00 jackson-databind-2.21.4-1.el9_6.src.rpm SHA-256: a1da8e770b4123fe6cfcd579925b2bbed779db1372351fa83a09f9397d73d69c jackson-jaxrs-providers-2.21.4-1.el9_6.src.rpm SHA-256: 8be44fc4638b373edd93b34526e0255d5ccd56eb1934c8d399a20fe0ac08dc61 jackson-modules-base-2.21.4-1.el9_6.src.rpm SHA-256: 57677f53e52ec378807f517afc95d94761e296315df6f3fd4ef2c3093f96ed3e ppc64le pki-jackson-annotations-2.21-1.el9_6.noarch.rpm SHA-256: 11e459f7e85daa60cfcdd105b4e360f4ee86f4fa66878fd12221a3f710e65598 pki-jackson-core-2.21.4-1.el9_6.noarch.rpm SHA-256: bd533970179fbd6d59b20e4f9c7a50de9abf66d9a8662c4161cc8e6e917c4558 pki-jackson-databind-2.21.4-1.el9_6.noarch.rpm SHA-256: fee35bf717a1b4ad11f6a90f7b626f9e33417e500758f21f3ac45a4efc787e36 pki-jackson-jaxrs-json-provider-2.21.4-1.el9_6.noarch.rpm SHA-256: 2385d84d19b996e0afbe18b20716f8b72acc81c3817de4616a9a001df875f9e3 pki-jackson-jaxrs-providers-2.21.4-1.el9_6.noarch.rpm SHA-256: 59d567b1fb06c0504e6e7c61732176163fc715e9aed26f34c655a8f7ab08779f pki-jackson-module-jaxb-annotations-2.21.4-1.el9_6.noarch.rpm SHA-256: 3916fad43dae7cc271cbcbc1bb0870895afc170ca89ccd02182b969165768662 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 SRPM jackson-annotations-2.21-1.el9_6.src.rpm SHA-256: d16b0fb0c7b8a11ed4a0fd005780b65e5689adb74e88fdb161da69c96af3c2df jackson-core-2.21.4-1.el9_6.src.rpm SHA-256: d71a6cb9287ecc5a683a5bf07ad94bad65e376cdab82b2859e44575503072c00 jackson-databind-2.21.4-1.el9_6.src.rpm SHA-256: a1da8e770b4123fe6cfcd579925b2bbed779db1372351fa83a09f9397d73d69c jackson-jaxrs-providers-2.21.4-1.el9_6.src.rpm SHA-256: 8be44fc4638b373edd93b34526e0255d5ccd56eb1934c8d399a20fe0ac08dc61 jackson-modules-base-2.21.4-1.el9_6.src.rpm SHA-256: 57677f53e52ec378807f517afc95d94761e296315df6f3fd4ef2c3093f96ed3e aarch64 pki-jackson-annotations-2.21-1.el9_6.noarch.rpm SHA-256: 11e459f7e85daa60cfcdd105b4e360f4ee86f4fa66878fd12221a3f710e65598 pki-jackson-core-2.21.4-1.el9_6.noarch.rpm SHA-256: bd533970179fbd6d59b20e4f9c7a50de9abf66d9a8662c4161cc8e6e917c4558 pki-jackson-databind-2.21.4-1.el9_6.noarch.rpm SHA-256: fee35bf717a1b4ad11f6a90f7b626f9e33417e500758f21f3ac45a4efc787e36 pki-jackson-jaxrs-json-provider-2.21.4-1.el9_6.noarch.rpm SHA-256: 2385d84d19b996e0afbe18b20716f8b72acc81c3817de4616a9a001df875f9e3 pki-jackson-jaxrs-providers-2.21.4-1.el9_6.noarch.rpm SHA-256: 59d567b1fb06c0504e6e7c61732176163fc715e9aed26f34c655a8f7ab08779f pki-jackson-module-jaxb-annotations-2.21.4-1.el9_6.noarch.rpm SHA-256: 3916fad43dae7cc271cbcbc1bb0870