IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.1Hoch

CVE-2026-54513jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

FasterXML jackson-databind; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1 Veröffentlicht: (vor 4 Monaten)

Beschreibung

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Schwachstellentyp (CWE): CWE-184

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
amq streams 3.2 —
build keycloak 26.4 —
build keycloak 26.6 —
certificate system 10.8 —
cryostat 4 —
FasterXML jackson-databind >= 2.10.0, < 2.18.8, >= 2.19.0, < 2.21.4, >= 3.0.0, < 3.1.4
openshift devspaces 3.30 —
Red Hat Cryostat 4 on RHEL 9 all versions
Red Hat OpenShift Developer Tools and Services —
Red Hat OpenShift Serverless —
Red Hat Red Hat AI Inference Server —
Red Hat Red Hat AMQ Broker 7.13.6 —
Red Hat Red Hat AMQ Broker 7.14.1 —
Red Hat Red Hat AMQ Clients all versions
Red Hat Red Hat Ansible Automation Platform 2 —
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 all versions
Red Hat Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 —
Red Hat Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16 —
Red Hat Red Hat build of Apache Camel - HawtIO 4 all versions
Red Hat Red Hat build of Apicurio Registry 3 all versions
Red Hat Red Hat build of Debezium 3 all versions
Red Hat Red Hat build of Keycloak 26.4 all versions
Red Hat Red Hat build of Keycloak 26.4.14 all versions
Red Hat Red Hat build of Keycloak 26.6 all versions
Red Hat Red Hat build of Keycloak 26.6.5 all versions
Red Hat Red Hat Certificate System 10.8 for RHEL-8 all versions
Red Hat Red Hat Data Grid 8.6.2 —
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On all versions
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On all versions
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 —
Red Hat Red Hat JBoss Enterprise Application Platform 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack —
Red Hat Red Hat Lightspeed for Runtimes Operator —
Red Hat Red Hat OpenShift Dev Spaces 3.30 all versions
Red Hat Streams for Apache Kafka 3.2.1 —

Referenzen und Patches

CPE-Treffer (NVD) (3)
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* ≥ 2.10.0 < 2.18.8
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* ≥ 2.19.0 < 2.21.4
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* ≥ 3.0.0 < 3.1.4

Neue CVEs im selben Produkt — Red Hat Enterprise Linux

6.2Mittel
CVE-2026-120749

Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesCha…

7.5Hoch
CVE-2026-123151

Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitr…

8.1Hoch
CVE-2026-121997

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actua…

8.2Hoch
CVE-2026-121996

Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeat…

7.5Hoch
CVE-2026-121995

Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale …

8.8Hoch
CVE-2026-121994

Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an allo…