Към съдържанието
Търсене

CVE-2026-54513: FasterXML jackson-databind, логическа грешка

8.1

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, при специфични условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Засегнати продукти

  • FasterXML jackson-databind: >= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4
  • Red Hat Cryostat 4 on RHEL 9: 4.2.0-13 преди *
  • Red Hat Red Hat AMQ Broker 7.13.6
  • Red Hat Red Hat AMQ Broker 7.14.1
  • Red Hat Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
  • Red Hat Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
  • Red Hat Red Hat build of Keycloak 26.4: 26.4.14-1 преди *
  • Red Hat Red Hat build of Keycloak 26.4.14
  • Red Hat Red Hat build of Keycloak 26.6: 26.6.5-1 преди *
  • Red Hat Red Hat build of Keycloak 26.6.5
  • Red Hat Red Hat Certificate System 10.8 for RHEL-8: 8100020260728001635.f9354743 преди *
  • Red Hat Red Hat Data Grid 8.6.2
  • Red Hat Red Hat Enterprise Linux 10: 0:11.9.0-4.el10_2 преди *
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support: 0:11.6.0-2.el10_0 преди *
  • Red Hat Red Hat Enterprise Linux 8: 8100020260714102233.489197e6 преди *
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: 8040020260720064222.522a0ee4 преди *
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: 8040020260720064222.522a0ee4 преди *
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: 8060020260720025549.ad008a3a преди *
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: 8060020260720025549.ad008a3a преди *
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service: 8080020260714161755.63b34585 преди *
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: 8080020260714161755.63b34585 преди *
  • Red Hat Red Hat Enterprise Linux 9: 0:2.21.4-1.el9_8 преди *
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: 0:2.21.4-1.el9_2 преди *
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: 0:2.21.4-1.el9_4 преди *
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support: 0:2.21.4-1.el9_6 преди *
  • Red Hat Streams for Apache Kafka 3.2.1
  • Red Hat Red Hat OpenShift Dev Spaces 3.30: 1787759145 преди *
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat AI Inference Server
  • Red Hat Red Hat AMQ Clients
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Lightspeed for Runtimes Operator
  • Red Hat Red Hat Offline Knowledge Portal
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka 2

Вид слабост

История

  • 23 юни 2026 Публикувано

Други уязвимости в FasterXML jackson-databind

Първоизточници

CVE-2026-54513: FasterXML jackson-databind, логическа грешка | freedomonline.bg