Two vulnerabilities (CVE-2026-54512 and CVE-2026-54513, both CVSS 8.1 HIGH) in the jackson-databind library bundled with dogtag-pki allow arbitrary code execution via a security bypass of the PolymorphicTypeValidator. Affected versions are fasterxml jackson-databind from 2.10.0 before 2.18.8, from 2.19.0 before 2.21.4, and from 3.0.0 before 3.1.4. The fix requires updating the underlying library to versions 2.18.8, 2.21.4, or 3.1.4, respectively, via the provided Red Hat security update.
Red Hat Product Errata RHSA-2026:44271 - Security Advisory Issued: 2026-07-23 Updated: 2026-07-23 RHSA-2026:44271 - Security Advisory Overview Updated Packages Synopsis Important: dogtag-pki security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for dogtag-pki is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: Certificate Authority (CA) Key Recovery Authority (KRA) Online Certificate Status Protocol (OCSP) Manager Token Key Service (TKS) Token Processing Service (TPS) Automatic Certificate Management Environment (ACME) Responder Enrollment over Secure Transport (EST) Responder Security Fix(es): jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2492010 - CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution BZ - 2492015 - CVE-2026-54512 jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass CVEs CVE-2026-54512 CVE-2026-54513 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM dogtag-pki-11.6.0-2.el10_0.src.rpm SHA-256: e18ab8cf309926295646ee71f2849aa482837d32b37dba52abd01b3fee37a6fe x86_64 dogtag-pki-debugsource-11.6.0-2.el10_0.x86_64.rpm SHA-256: 19fed5e1d06d67f798dfbd6c3e4a4fbc6a0fdb8029c0c590400f0984c5c88cd6 idm-pki-acme-11.6.0-2.el10_0.noarch.rpm SHA-256: f82f9666f62ca4affb113c541459eda048ca7b5c80cd7dacf3910a4d67978e1d idm-pki-base-11.6.0-2.el10_0.noarch.rpm SHA-256: a747380590b26c96e1cddd88bd4b67364094d753a2e37608340b773a23658181 idm-pki-ca-11.6.0-2.el10_0.noarch.rpm SHA-256: 7ecc3ac96aa4891c2b88c41290edaa00be65099365eae86e31f0ef5e8b812695 idm-pki-java-11.6.0-2.el10_0.noarch.rpm SHA-256: e529de953bf2d705f0a3a43b2356cbb13f03b8b5521a759be775d5604b1565f3 idm-pki-kra-11.6.0-2.el10_0.noarch.rpm SHA-256: c90750df5d1536a791eeba32c8d7e99a362af66973e6078851be22a88167fc6f idm-pki-server-11.6.0-2.el10_0.noarch.rpm SHA-256: b020498512a936706f5349acb1407283cf9b877bc4bc9bf7967ed3250cdb4633 idm-pki-tools-11.6.0-2.el10_0.x86_64.rpm SHA-256: 9b0b550aa31575eb63fceb7a52cc798bf3d4936aa0d53553319b26c505a2088d idm-pki-tools-debuginfo-11.6.0-2.el10_0.x86_64.rpm SHA-256: b1df97a5afda4867260518b76f4b78d57aae7cc62d17c5432aaaab8a997f8ec0 python3-idm-pki-11.6.0-2.el10_0.noarch.rpm SHA-256: 4f651baa7a876fef687b7675b9eba1df424c6c0a8eb0bc189efa2aa6d5d2966b Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 SRPM dogtag-pki-11.6.0-2.el10_0.src.rpm SHA-256: e18ab8cf309926295646ee71f2849aa482837d32b37dba52abd01b3fee37a6fe s390x dogtag-pki-debugsource-11.6.0-2.el10_0.s390x.rpm SHA-256: d663500ac3b5e32174e32ed04927f64cb840fcd36e4f798298efc06eac28305b idm-pki-acme-11.6.0-2.el10_0.noarch.rpm SHA-256: f82f9666f62ca4affb113c541459eda048ca7b5c80cd7dacf3910a4d67978e1d idm-pki-base-11.6.0-2.el10_0.noarch.rpm SHA-256: a747380590b26c96e1cddd88bd4b67364094d753a2e37608340b773a23658181 idm-pki-ca-11.6.0-2.el10_0.noarch.rpm SHA-256: 7ecc3ac96aa4891c2b88c41290edaa00be65099365eae86e31f0ef5e8b812695 idm-pki-java-11.6.0-2.el10_0.noarch.rpm SHA-256: e529de953bf2d705f0a3a43b2356cbb13f03b8b5521a759be775d5604b1565f3 idm-pki-kra-11.6.0-2.el10_0.noarch.rpm SHA-256: c90750df5d1536a791eeba32c8d7e99a362af66973e6078851be22a88167fc6f idm-pki-server-11.6.0-2.el10_0.noarch.rpm SHA-256: b020498512a936706f5349acb1407283cf9b877bc4bc9bf7967ed3250cdb4633 idm-pki-tools-11.6.0-2.el10_0.s390x.rpm SHA-256: 470c23ec27dbfe62f1ee85fd33e4adf7180ff3f53e36406f67bc2097124cf0a4 idm-pki-tools-debuginfo-11.6.0-2.el10_0.s390x.rpm SHA-256: 86ab4b704e7f9d57ace96e78e88b672be8f3f68993f73485d9e116034cf90de3 python3-idm-pki-11.6.0-2.el10_0.noarch.rpm SHA-256: 4f651baa7a876fef687b7675b9eba1df424c6c0a8eb0bc189efa2aa6d5d2966b Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 SRPM dogtag-pki-11.6.0-2.el10_0.src.rpm SHA-256: e18ab8cf309926295646ee71f2849aa482837d32b37dba52abd01b3fee37a6fe ppc64le dogtag-pki-debugsource-11.6.0-2.el10_0.ppc64le.rpm SHA-256: 5dccde46e00a52f7913e054c92a3b4a6b85e667cb40de643b42cb6a1ebc152e8 idm-pki-acme-11.6.0-2.el10_0.noarch.rpm SHA-256: f82f9666f62ca4affb113c541459eda048ca7b5c80cd7dacf3910a4d67978e1d idm-pki-base-11.6.0-2.el10_0.noarch.rpm SHA-256: a747380590b26c96e1cddd88bd4b67364094d753a2e37608340b773a23658181 idm-pki-ca-11.6.0-2.el10_0.noarch.rpm SHA-256: 7ecc3ac96aa4891c2b88c41290edaa00be65099365eae86e31f0ef5e8b812695 idm-pki-java-11.6.0-2.el10_0.noarch.rpm SHA-256: e529de953bf2d705f0a3a43b2356cbb13f03b8b5521a759be775d5604b1565f3 idm-pki-kra-11.6.0-2.el10_0.noarch.rpm SHA-256: c90750df5d1536a791eeba32c8d7e99a362af66973e6078851be22a88167fc6f idm-pki-server-11.6.0-2.el10_0.noarch.rpm SHA-256: b020498512a936706f5349acb1407283cf9b877bc4bc9bf7967ed3250cdb4633 idm-pki-tools-11.6.0-2.el10_0.ppc64le.rpm SHA-256: a79d9986ff1c3ab33c67a908c9366e719e2dd467e35e07a83b512da3f93b949f idm-pki-tools-debuginfo-11.6.0-2.el10_0.ppc64le.rpm SHA-256: 2ea7f8d854742f7d0902699f5da4ed67c5773a1b81e7cef9a5227b1ffff82b6d python3-idm-pki-11.6.0-2.el10_0.noarch.rpm SHA-256: 4f651baa7a876fef687b7675b9eba1df424c6c0a8eb0bc189efa2aa6d5d2966b Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 SRPM dogtag-pki-11.6.0-2.el10_0.src.rpm SHA-256: e18ab8cf309926295646ee71f2849aa482837d32b37dba52abd01b3fee37a6fe aarch64 dogtag-pki-debugsource-11.6.0-2.el10_0.aarch64.rpm SHA-256: 73f5ce1e147acc72045761e3eca731a60bd1c9a2dc23b77ccf68830e47d96370 idm-pki-acme-11.6.0-2.el10_0.noarch.rpm SHA-256: f82f9666f62ca4affb113c541459eda048ca7b5c80cd7dacf3910a4d67978e1d idm-pki-base-11.6.0-2.el10_0.noarch.rpm SHA-256: a747380590b26c96e1cddd88bd4b67364094d753a2e37608340b773a23658181 idm-pki-ca-11.6.0-2.el10_0.noarch.rpm SHA-256: 7ecc3ac96aa4891c2b88c41290edaa00be65099365eae86e31f0ef5e8b812695 idm-pki-java-11.6.0-2.el10_0.noarch.rpm SHA-256: e529de953bf2d705f0a3a43b2356cbb13f03b8b5521a759be775d5604b1565f3 idm-pki-kra-11.6.0-2.el10_0.noarch.rpm SHA-256: c90750df5d1536a791eeba32c8d7e99a362af66973e6078851be22a88167fc6f idm-pki-server-11.6.0-2.el10_0.noarch.rpm SHA-256: b020498512a936706f5349acb1407283cf9b877bc4bc9bf7967ed3250cdb4633 idm-pki-tools-11.6.0-2.el10_0.aarch64.rpm SHA-256: 95567bb85ba8ba7e6298c42743428b36dda0bfe046ddfa887311d7b857bb501b idm-pki-tools-debuginfo-11.6.0-2.el10_0.aarch64.rpm SHA-256: f17004d67bd2000a03af28c088b67f5d317a1da3534d3abeb2be6f027988a941 python3-idm-pki-11.6.0-2.el10_0.noarch.rpm SHA-256: 4f651baa7a876fef687b7675b9eba1df424c6c0a8eb0bc189efa2aa6d5d2966b Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 SRPM dogtag-pki-11.6.0-2.el10_0.src.rpm SHA-256: e18ab8cf309926295646ee71f2849aa482837d32b37dba52abd01b3fee37a6fe aarch64 dogtag-pki-debugsource-11.6.0-2.el10_0.aarch64.rpm SHA-256: 73f5ce1e147acc72045761e3eca731a60bd1c9a2dc23b77ccf68830e47d96370 idm-pki-acme-11.6.0-2.el10_0.noarch.rpm SHA-256: f82f9666f62ca4affb113c541459eda048ca7b5c80cd7dacf3910a4d67978e1d idm-pki-base-11.6.0-2.el10_0.noarch.rpm SHA-256: a747380590b26c96e1cddd88bd4b67364094d753a2e37608340b773a23658181 idm-pki-ca-11.6.0-2.el10_0.noarch.rpm SHA-256: 7ecc3ac96aa4891c2b88c41290edaa00be65099365eae86e31f0ef5e8b812695 idm-pki-java-11.6.0-2.el10_0.noarch.rpm SHA-256: e529de953bf2d705f0a3a43b2356cbb13f03b8b5521a759be775d5604b1565f3 idm-pki-kra-11.6.0-2.el10_0.noarch.rpm SHA-256: c90750df5d1536a791eeba32c8d7e99a362af66973e6078851be22a88167fc6f idm-pki-server-11.6.0-2.el10_0.noarch.rpm SHA-256: b020498512a936706f5349acb1407283cf9b877bc4bc9bf7967ed3250cdb4633 idm-pki-tools-11.6.0-2.el10_0.aarch64.rpm SHA-256: 95567bb85ba8ba7e6298c42743428b36dda0bfe046ddfa887311d7b857bb501b idm-pki-tools-debuginfo-11.6.0-2.el10_0.aarch64.rpm SHA-256: f17004d67bd2000a03af28c088b67f5d317a1da3534d3abeb2be6f027988a941 python3-idm-pki-11.6.0-2.el10_0.noarch.rpm SHA-256: 4f651baa7a876fef687b7675b9eba1df424c6c0a8eb0bc189efa2aa6d5d2966b Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 SRPM dogtag-pki-11.6.0-2.el10_0.src.rpm SHA-256: e18ab8cf309926295646ee71f2849aa482837d32b37dba52abd01b3fee37a6fe s390x dogtag-pki-debugsource-11.6.0-2.el10_0.s390x.rpm SHA-256: d663500ac3b5e32174e32ed04927f64cb840fcd36e4f798298efc06eac28305b idm-pki-acme-11.6.0-2.el10_0.noarch.rpm SHA-256