Red Hat Product Errata RHSA-2026:44062 - Security Advisory Issued: 2026-07-23 Updated: 2026-07-23 RHSA-2026:44062 - Security Advisory Overview Updated Packages Synopsis Important: pki-deps:10.6 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the pki-deps:10.6 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Security Fix(es): jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 x86_64 Red Hat Enterprise Linux Server - AUS 8.4 x86_64 Fixes BZ - 2492010 - CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution BZ - 2492015 - CVE-2026-54512 jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass CVEs CVE-2026-54512 CVE-2026-54513 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 SRPM apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 8808d86cf51fbacb8385c8ab63619325a63a5b9c01d511b20f8116963d3ecd25 apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 8d21f5d5b04d5f6115278eb5610c074914188e978c7f3e4ba4efa9af9a90552a apache-commons-net-3.6-3.module+el8.3.0+6805+72837426.src.rpm SHA-256: b107a38acb94ca4c07b39a0ebd9cb78cc98b96a860b9d90f6d1ae2d6557d3d62 bea-stax-1.2.0-16.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 6df5604c39f96f7bc1f72c2704d8af3e910773675f41751eeab3e92844c4f266 fasterxml-oss-parent-75-1.module+el8.4.0+24531+dcbbef34.src.rpm SHA-256: 75450577da6dbc23865fd2fbd83cbc33b4d41eb144d8ba8654c9636e273340c3 glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 54904a53c89d2e4c6b4500e3ccfbb15a21d01087d651f36f01c155ed88637934 glassfish-jaxb-2.2.11-11.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: fefd1ddbf106bf9e6c091f61a4215030c4db3c53068ef29f60f05abe36c4e4ac glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 4533ff42e7e841e1e1103d65a11509cc85a119c839109af0ff6df0c07b3a3e56 jackson-annotations-2.21-1.module+el8.4.0+24531+dcbbef34.src.rpm SHA-256: 85cbfe62622eec60624cf9a3bab60d6d876ab0af918b1494ef8f7762f614edc0 jackson-bom-2.21.4-1.module+el8.4.0+24531+dcbbef34.src.rpm SHA-256: 29d256233e5237ef3f7f8f88b9432bc76336b3c23021ac44952c361e3e804e9d jackson-core-2.21.4-1.module+el8.4.0+24531+dcbbef34.src.rpm SHA-256: 4a09ff46b340ef244c4806b4abb7fa04f89dbf120179842062a638aedc26c4cf jackson-databind-2.21.4-1.module+el8.4.0+24531+dcbbef34.src.rpm SHA-256: 0dce284dfae6ef9062e0cb65ffb4b333e1b0793d976b1ad8931a0a63bd27e7e3 jackson-jaxrs-providers-2.21.4-1.module+el8.4.0+24531+dcbbef34.src.rpm SHA-256: 2feca7b73807b717c3f4cf6b06c2bbc8ba655650ab7a77210ebaf12f2741f592 jackson-modules-base-2.21.4-1.module+el8.4.0+24531+dcbbef34.src.rpm SHA-256: 06ccc5c056d9dd56e52f80c0a4887a4add7c448f2d4d1cde8f39ab693dda922d jackson-parent-2.21-1.module+el8.4.0+24531+dcbbef34.src.rpm SHA-256: a2135699a34cac46044274745b5fe9073930fc307785f32c932ac61d87c174f2 jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 50276786098d4b9f278949f2d29cc3f9c803519053acfd5446289741d61fa9be javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: f7758844e90881da0ab7cf51f23766930102407063cb133056781b8ec7cdd328 pki-servlet-engine-9.0.30-1.module+el8.4.0+23942+fa6501e9.3.src.rpm SHA-256: 4b962efc3c9b03ec602a7a7e00badf162608e5eb66d874f6d608890f83d7875f python-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 78de9422d12b295fa42e145dd6b9ba8fd9394ca98976199c70f4f03656242170 relaxngDatatype-2011.1-7.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 56290e8587b6a8a88ba2f7e05c7e629562889565430cd7d45622515ac3e7a1e0 resteasy-3.0.26-6.module+el8.4.0+23399+fc91639f.src.rpm SHA-256: de4b3b73c359f4316c7a7131f9d8a8cc913b468f1073f4f110e98ee675bd7623 slf4j-1.7.25-4.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 9658c2a5e83e3db3e37c4bc43de7cb3ccac3e07d814c64d8fd872e5cb3cdc0a2 stax-ex-1.7.7-8.module+el8.2.0+5723+4574fbff.src.rpm SHA-256: b1f9e5823d9629fb58bbb3722d40015b5e9c4a1acde507bdcb60fcd24f9ac806 velocity-1.7-24.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 2d66b2fc4920e5c656bc6b0cf0669634ae0854f3f5fbce481ba6b73c8fcba83f xalan-j2-2.7.1-38.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: ebd234a3e289cbc121b7224bde246ae06348d0d1b5c763c54aa22b13389d93e3 xerces-j2-2.11.0-34.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 1e8befbd26490fbd854478e1ec42345ac6fbe56299797abcd0bc847536ba7c20 xml-commons-apis-1.4.01-25.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 13c235e3991694ed5d0b937514da067bc7ef249e5d3cd0b875e7468ec422688d xml-commons-resolver-1.2-26.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 9be8f11924dfb904c88ca012ccd8ca45bbca025b54cfecf6f894a16385dee090 xmlstreambuffer-1.5.4-8.module+el8.2.0+5723+4574fbff.src.rpm SHA-256: 94083d7550925a1eecd68c53c168432d55afeb67d9bc0eae4a9545060b57df13 xsom-0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src.rpm SHA-256: 5c5c569ee17f3b125d907202af3940d3b870f49e205e6e3af7eca3b90357b1fd x86_64 apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch.rpm SHA-256: 61032ccfc3d125b1882c55dfc06101098b149aaaf78261f4d78104819b67e654 apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch.rpm SHA-256: 324413ffde38b0e68fb4633ae751e74f06dd29d9845cc394dd75234a1c67534c apache-commons-net-3.6-3.module+el8.3.0+6805+72837426.noarch.rpm SHA-256: 44fa1e0d3a22e9e6e72cedb8a7104441ad780d2cd1fe4e7fc9832634a9297700 bea-stax-api-1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch.rpm SHA-256: 5698297dddd2ffe6cb398bf43338f3153040c3e47c40e7cd271fa88076240e11 fasterxml-oss-parent-75-1.module+el8.4.0+24531+dcbbef34.noarch.rpm SHA-256: a83e719ab6990d3fa53d7cdfbb955077857b6076eb13ca710282f57157eef8a3 glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch.rpm SHA-256: 59b0c5aee838fc3f60c471fd22a62c7bf7b3e7be3bc1e90f438d93652edae755 glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch.rpm SHA-256: 230eccdbf84113f5dce6f26c5da178a7234b43620e779f4a6c71a18aa3ded1aa glassfish-jaxb-core-2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch.rpm SHA-256: bf8be858f41d6742b74511b5f9ebacd9749a35c42c715c0d49ce7325de025926 glassfish-jaxb-runtime-2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch.rpm SHA-256: ed75a05cd326da7ab45df8f813c9ee87e68b3633462ec01a5bd31ae362f9efce glassfish-jaxb-txw2-2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch.rpm SHA-256: ff5a17869359c38652f645729e2051008f7df309dfdb9d4546c054bcee255d44 jackson-annotations-2.21-1.module+el8.4.0+24531+dcbbef34.noarch.rpm SHA-256: 3c4ec6cbd130b56be2b45cff382edfcff688aacd391b7de166e7a27658b1f905 jackson-bom-2.21.4-1.module+el8.4.0+24531+dcbbef34.noarch.rpm SHA-256: 9b4f3caa98832c9e426060fc170b92294a91212ccaeeadc0fc7d9d1f72b193c6 jackson-core-2.21.4-1.module+el8.4.0+24531+dcbbef34.noarch.rpm SHA-256: 3ee3f188e3205cf51f20c12e8f00b6babba080cfd5b6458ecf96b5c47a685b53 jackson-databind-2.21.4-1.module+el8.4.0+24531+dcbbef34.noarch.rpm SHA-256: a5071fd08e2cfc965233ba76b6e2e4b77756329f848a6a89a749901600ca3844 jackson-jaxrs-json-provider-2.21.4-1.module+el8.4.0+24531+dcbbef34.noarch.rpm SHA-256: 0901218c0535811c782d10c0546e4dbd10d4f2095a4db7419357a4cc8e2a9c11 jackson-jaxrs-providers-2.21.4-1.module+el8.4.0+24531+dcbbef34.noarch.rpm SHA-256: 22f7f078894a9e173eadb9e963e63a8207c01041ff90315ede139f73a3ca6633 jackson-module-jaxb-annotations-2.21.4-1.module+el8.4.0+24531+dcbbef34.noarch.rpm SHA-256: 2ee85b5ea21c131ee3a60eb68c3fbca40c6ba1ff1a41942236697e4ff88d754e jackson-modules-base-2.21.4-1.module+el8.4.0+24531+dcbbef34.noarch.rpm SHA-256: cf8c59db2c7fd5ea2aa5407f51d0d4926592b3e6932b0f7eea978c5da7a81634 jackson-parent-2.21-1.module+el8.4.0+24531+dcbbef34.noarch.rpm SHA-256: 581a466ef0bd395432aa3fcf801fbced1b6e9a85b89d2846a037ac919a5a1ec8 jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c.noarch.rpm SHA-256: 8086eed8f36137ac5f481057e0bcd04d0bf57f2c9bccc2bb0fc3feb06f574061 javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch.rpm SHA-256: 1e7af30426ec8abe97a466764f13ea870b51198b89ae774c1b61f4ac0cc3de72 javassist-javadoc-3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch.rpm SHA-256: e740b18bb372f1986a598c5c04f0e7a2c985feca0d8178136870a6b838367cd5 pki-servlet-4.0-api-9.0.30-1.module+el8.4.0+23942+fa6501e9.3.noarch.rpm SHA-256: 5adfc2443156278085fa1857cfa07e4dd34cf993f0647bbc8047fb68bbc0e190 pki-servlet-engine-9.0.30-1.module+el8.4.0+23942+fa6501e9.3.noarch.rpm SHA-256: d61d99e9f49a2dea425f39b959ada5d92cfe591f1e2ef902a69d73a81c4f9f2f python-nss-debugsource-1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64.rpm SHA-256: ca0fa12ad8c1c6931da5b67d2b85689244608021d7225c979c99476179e4a351 python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64.rpm SHA-256: c935d1b335fd1e997012840c5b6a4266f