{"id":"CVE-2026-54513","title":"jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)","summary":"A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the syst…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-184","vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream E4S (v.8.8)","affected":["build_of_apache_camel_hawtio 4","build_of_apache_camel_4_for_quarkus 3","build_of_apicurio_registry 3","build_of_debezium 3","jboss_enterprise_application_platform 7","jboss_enterprise_application_platform 8","openshift_dev_spaces","single_sign_on 7","streams_for_apache_kafka 2","certificate_system_10_8_for_rhel 8","cryostat_4_on_rhel 9","build_of_keycloak 26.4","build_of_keycloak 26.6","amq_clients 2026.Q3","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_eus_extension_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_eus_extension_v_8_6","enterprise_linux_appstream_e4s_v_8_8","enterprise_linux_appstream_tus_v_8_8","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","amq_broker 7.13.6","amq_broker 7.14.1","data_grid 8.6.2","openshift_dev_spaces 3.30","build_of_apache_camel_4_18_3_for_spring_boot 3.5.16","build_of_keycloak 26.4.14","build_of_keycloak 26.6.5","streams_for_apache_kafka 3.2.1"],"patched":["certificate_system_10_8_for_rhel 8","cryostat_4_on_rhel 9","build_of_keycloak 26.4","build_of_keycloak 26.6","amq_clients 2026.Q3","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_eus_extension_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_eus_extension_v_8_6","enterprise_linux_appstream_e4s_v_8_8","enterprise_linux_appstream_tus_v_8_8","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","amq_broker 7.13.6","amq_broker 7.14.1","data_grid 8.6.2","openshift_dev_spaces 3.30","build_of_apache_camel_4_18_3_for_spring_boot 3.5.16","build_of_keycloak 26.4.14","build_of_keycloak 26.6.5","streams_for_apache_kafka 3.2.1"],"published":"2026-06-23","updated":"2026-09-21","sourceUpdated":"2026-09-21T16:11:36+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-54513"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492010"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54513"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513"},{"url":"https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"},{"url":"https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"},{"url":"https://github.com/FasterXML/jackson-databind/issues/5981"},{"url":"https://github.com/FasterXML/jackson-databind/issues/5983"},{"url":"https://github.com/FasterXML/jackson-databind/pull/5984"},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f"},{"url":"https://access.redhat.com/errata/RHSA-2026:48095"},{"url":"https://access.redhat.com/errata/RHSA-2026:48151"},{"url":"https://access.redhat.com/errata/RHSA-2026:50847"},{"url":"https://access.redhat.com/errata/RHSA-2026:50849"},{"url":"https://access.redhat.com/errata/RHSA-2026:69459"},{"url":"https://access.redhat.com/errata/RHSA-2026:44271"},{"url":"https://access.redhat.com/errata/RHSA-2026:43400"},{"url":"https://access.redhat.com/errata/RHSA-2026:43218"},{"url":"https://access.redhat.com/errata/RHSA-2026:44062"},{"url":"https://access.redhat.com/errata/RHSA-2026:44061"},{"url":"https://access.redhat.com/errata/RHSA-2026:44066"},{"url":"https://access.redhat.com/errata/RHSA-2026:44063"},{"url":"https://access.redhat.com/errata/RHSA-2026:44065"},{"url":"https://access.redhat.com/errata/RHSA-2026:44064"},{"url":"https://access.redhat.com/errata/RHSA-2026:40895"},{"url":"https://access.redhat.com/errata/RHSA-2026:66545"},{"url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"url":"https://access.redhat.com/errata/RHSA-2026:41951"},{"url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"url":"https://access.redhat.com/errata/RHSA-2026:54622"},{"url":"https://access.redhat.com/errata/RHSA-2026:36839","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50846","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50848","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f"}],"tags":["csaf","vex","red-hat","cve.org","nvd","ghsa","maven"],"epss":0.00892,"epssPercentile":0.574,"aliases":["GHSA-rmj7-2vxq-3g9f"],"ecosystem":"maven","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-06-24T14:45:02.581065Z"},"ingestedAt":"2026-06-26T16:43:14.617Z","slug":"CVE-2026-54513","body":"## Overview\n\nA flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.\n\n## Vendor advisories\n\n- **RHSA-2026:48095** · Red Hat · fixed in: Red Hat Certificate System 10.8 for RHEL 8 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48095)\n- **RHSA-2026:48151** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48151)\n- **RHSA-2026:50847** · Red Hat · fixed in: Red Hat build of Keycloak 26.4 · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50847)\n- **RHSA-2026:50849** · Red Hat · fixed in: Red Hat build of Keycloak 26.6 · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50849)\n- **RHSA-2026:69459** · Red Hat · fixed in: AMQ Clients 2026.Q3 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69459)\n- **RHSA-2026:44271** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44271)\n- **RHSA-2026:43400** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43400)\n- **RHSA-2026:43218** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43218)\n- **RHSA-2026:44062** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44062)\n- **RHSA-2026:44061** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44061)\n- **RHSA-2026:44066** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44066)\n- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, … · no fix planned: Red Hat build of Debezium 3, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, Red Hat build of Apache Camel - HawtIO 4, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json)\n- **RHSA-2026:44063** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44063)\n\n**jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution** — rated Important by Red Hat. Released 2026-06-23, updated 2026-09-21.\n\nAffected:\n\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apicurio Registry 3\n- Red Hat build of Debezium 3\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat JBoss Enterprise Application Platform 8\n- Red Hat OpenShift Dev Spaces\n- Red Hat Single Sign-On 7\n- streams for Apache Kafka 2\n\nFixed:\n\n- Red Hat Certificate System 10.8 for RHEL 8\n- Cryostat 4 on RHEL 9\n- Red Hat build of Keycloak 26.4\n- Red Hat build of Keycloak 26.6\n- AMQ Clients 2026.Q3\n- Red Hat Enterprise Linux AppStream EUS (v. 10.0)\n- Red Hat Enterprise Linux AppStream (v. 10)\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream AUS (v.8.4)\n- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\n- Red Hat Enterprise Linux AppStream AUS (v.8.6)\n- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)\n- Red Hat Enterprise Linux AppStream E4S (v.8.8)\n- Red Hat Enterprise Linux AppStream TUS (v.8.8)\n- Red Hat Enterprise Linux AppStream E4S (v.9.2)\n- Red Hat Enterprise Linux AppStream E4S (v.9.4)\n- Red Hat Enterprise Linux AppStream EUS (v.9.6)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat AMQ Broker 7.13.6\n- Red Hat AMQ Broker 7.14.1\n- Red Hat Data Grid 8.6.2\n- Red Hat OpenShift Dev Spaces 3.30\n- Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16\n- Red Hat build of Keycloak 26.4.14\n- Red Hat build of Keycloak 26.6.5\n- Streams for Apache Kafka 3.2.1\n\nNo fix planned:\n\n- Red Hat build of Debezium 3\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat Single Sign-On 7\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apicurio Registry 3\n- Red Hat JBoss Enterprise Application Platform 8\n- Red Hat OpenShift Dev Spaces\n- streams for Apache Kafka 2\n\nNot affected:\n\n- Cryostat 4 on RHEL 9\n- Red Hat Enterprise Linux AppStream E4S (v.9.2)\n- Red Hat Enterprise Linux AppStream E4S (v.9.4)\n- Red Hat Enterprise Linux AppStream EUS (v.9.6)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat OpenShift Dev Spaces 3.30\n- OpenShift Developer Tools and Services\n- OpenShift Serverless\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:48095\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:48151\nBefore applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on. https://access.redhat.com/errata/RHSA-2026:50847\n\nWorkarounds / mitigations:\n\n- Upgrade to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the application’s ObjectMapper configuration to eliminate the affected deserialization path. Rebuild and restart the application to apply the configuration change.\n\nAs an additional mitigation, disable polymorphic deserialization of untrusted data where possible by avoiding or removing default typi…\n\n## Package advisory (CVE-2026-54513)\n\nAffected packages:\n\n- `com.fasterxml.jackson.core:jackson-databind >= 2.10.0, < 2.18.8`\n- `com.fasterxml.jackson.core:jackson-databind >= 2.19.0, < 2.21.4`\n- `com.fasterxml.jackson.core:jackson-databind >= 3.0.0, < 3.1.4`\n- `tools.jackson.core:jackson-databind >= 3.0.0, < 3.1.4`\n\nPatched in:\n\n- `com.fasterxml.jackson.core:jackson-databind 2.18.8`\n- `com.fasterxml.jackson.core:jackson-databind 2.21.4`\n- `com.fasterxml.jackson.core:jackson-databind 3.1.4`\n- `tools.jackson.core:jackson-databind 3.1.4`\n\nSource: https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}