Two critical vulnerabilities (CVE-2026-54512 and CVE-2026-54513, both CVSS 8.1 High) in Jackson-databind allow arbitrary code execution via a bypass of the PolymorphicTypeValidator security mechanism. Affected versions are jackson-databind 2.10.0 through 2.18.7, 2.19.0 through 2.21.3, and 3.0.0 through 3.1.3. The fixed versions are 2.18.8, 2.21.4, and 3.1.4, which must be applied to remediate the risk.
Red Hat Product Errata RHSA-2026:40895 - Security Advisory Issued: 2026-07-16 Updated: 2026-07-16 RHSA-2026:40895 - Security Advisory Overview Updated Packages Synopsis Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for multiple packages is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fix(es): jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2492010 - CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution BZ - 2492015 - CVE-2026-54512 jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass CVEs CVE-2026-54512 CVE-2026-54513 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM jackson-annotations-2.21-1.el9_8.src.rpm SHA-256: 829c52041e5008b8b3c090c1000c13ea46ea9e0152e23c12340c15c9c1dc352a jackson-core-2.21.4-1.el9_8.src.rpm SHA-256: 76bf003fac2a858ddcaf52c83d938c5ae61026c598d91ded7f32666ce73c9d1e jackson-databind-2.21.4-1.el9_8.src.rpm SHA-256: 222d54a87bdb0a8e9d6dd9aaf293f07d1f2002aa00578dd2b2287e1df0a515e7 jackson-jaxrs-providers-2.21.4-1.el9_8.src.rpm SHA-256: 6232e5269255069a372d174436cc5ea3ba3808d21f2e70656cf92f03c26a4959 jackson-modules-base-2.21.4-1.el9_8.src.rpm SHA-256: a15e246fd2cf4fec584f1517dfe2c8174bf7c467a5586fc198e9e0ed6930a304 x86_64 pki-jackson-annotations-2.21-1.el9_8.noarch.rpm SHA-256: dfdfecf5b10210cd3f4c24744a9edd6b97b1dab7b668d560ed43010d8a147041 pki-jackson-core-2.21.4-1.el9_8.noarch.rpm SHA-256: f12c4f028de61a609ce2a9a8594f0f825f284d7f72a823f824ac6c6bf765c1ba pki-jackson-databind-2.21.4-1.el9_8.noarch.rpm SHA-256: a4d6d467aad206c952b631b4515b40249eed0555b888fb895cf385be65976cb5 pki-jackson-jaxrs-json-provider-2.21.4-1.el9_8.noarch.rpm SHA-256: 4ad512b26f7788e02f968b4d2025f61e711a2077ca655202155f4de12dcbda46 pki-jackson-jaxrs-providers-2.21.4-1.el9_8.noarch.rpm SHA-256: 678bc5750f75a3311eb14e85f2700645ed9447a6cbfbebf44fdd82fae31586e6 pki-jackson-module-jaxb-annotations-2.21.4-1.el9_8.noarch.rpm SHA-256: 8fc1cd4877bc7c83e382de9f9d971fc0a59bae0d816d4741925ef5db6c18aaeb Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM jackson-annotations-2.21-1.el9_8.src.rpm SHA-256: 829c52041e5008b8b3c090c1000c13ea46ea9e0152e23c12340c15c9c1dc352a jackson-core-2.21.4-1.el9_8.src.rpm SHA-256: 76bf003fac2a858ddcaf52c83d938c5ae61026c598d91ded7f32666ce73c9d1e jackson-databind-2.21.4-1.el9_8.src.rpm SHA-256: 222d54a87bdb0a8e9d6dd9aaf293f07d1f2002aa00578dd2b2287e1df0a515e7 jackson-jaxrs-providers-2.21.4-1.el9_8.src.rpm SHA-256: 6232e5269255069a372d174436cc5ea3ba3808d21f2e70656cf92f03c26a4959 jackson-modules-base-2.21.4-1.el9_8.src.rpm SHA-256: a15e246fd2cf4fec584f1517dfe2c8174bf7c467a5586fc198e9e0ed6930a304 x86_64 pki-jackson-annotations-2.21-1.el9_8.noarch.rpm SHA-256: dfdfecf5b10210cd3f4c24744a9edd6b97b1dab7b668d560ed43010d8a147041 pki-jackson-core-2.21.4-1.el9_8.noarch.rpm SHA-256: f12c4f028de61a609ce2a9a8594f0f825f284d7f72a823f824ac6c6bf765c1ba pki-jackson-databind-2.21.4-1.el9_8.noarch.rpm SHA-256: a4d6d467aad206c952b631b4515b40249eed0555b888fb895cf385be65976cb5 pki-jackson-jaxrs-json-provider-2.21.4-1.el9_8.noarch.rpm SHA-256: 4ad512b26f7788e02f968b4d2025f61e711a2077ca655202155f4de12dcbda46 pki-jackson-jaxrs-providers-2.21.4-1.el9_8.noarch.rpm SHA-256: 678bc5750f75a3311eb14e85f2700645ed9447a6cbfbebf44fdd82fae31586e6 pki-jackson-module-jaxb-annotations-2.21.4-1.el9_8.noarch.rpm SHA-256: 8fc1cd4877bc7c83e382de9f9d971fc0a59bae0d816d4741925ef5db6c18aaeb Red Hat Enterprise Linux for IBM z Systems 9 SRPM jackson-annotations-2.21-1.el9_8.src.rpm SHA-256: 829c52041e5008b8b3c090c1000c13ea46ea9e0152e23c12340c15c9c1dc352a jackson-core-2.21.4-1.el9_8.src.rpm SHA-256: 76bf003fac2a858ddcaf52c83d938c5ae61026c598d91ded7f32666ce73c9d1e jackson-databind-2.21.4-1.el9_8.src.rpm SHA-256: 222d54a87bdb0a8e9d6dd9aaf293f07d1f2002aa00578dd2b2287e1df0a515e7 jackson-jaxrs-providers-2.21.4-1.el9_8.src.rpm SHA-256: 6232e5269255069a372d174436cc5ea3ba3808d21f2e70656cf92f03c26a4959 jackson-modules-base-2.21.4-1.el9_8.src.rpm SHA-256: a15e246fd2cf4fec584f1517dfe2c8174bf7c467a5586fc198e9e0ed6930a304 s390x pki-jackson-annotations-2.21-1.el9_8.noarch.rpm SHA-256: dfdfecf5b10210cd3f4c24744a9edd6b97b1dab7b668d560ed43010d8a147041 pki-jackson-core-2.21.4-1.el9_8.noarch.rpm SHA-256: f12c4f028de61a609ce2a9a8594f0f825f284d7f72a823f824ac6c6bf765c1ba pki-jackson-databind-2.21.4-1.el9_8.noarch.rpm SHA-256: a4d6d467aad206c952b631b4515b40249eed0555b888fb895cf385be65976cb5 pki-jackson-jaxrs-json-provider-2.21.4-1.el9_8.noarch.rpm SHA-256: 4ad512b26f7788e02f968b4d2025f61e711a2077ca655202155f4de12dcbda46 pki-jackson-jaxrs-providers-2.21.4-1.el9_8.noarch.rpm SHA-256: 678bc5750f75a3311eb14e85f2700645ed9447a6cbfbebf44fdd82fae31586e6 pki-jackson-module-jaxb-annotations-2.21.4-1.el9_8.noarch.rpm SHA-256: 8fc1cd4877bc7c83e382de9f9d971fc0a59bae0d816d4741925ef5db6c18aaeb Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 SRPM jackson-annotations-2.21-1.el9_8.src.rpm SHA-256: 829c52041e5008b8b3c090c1000c13ea46ea9e0152e23c12340c15c9c1dc352a jackson-core-2.21.4-1.el9_8.src.rpm SHA-256: 76bf003fac2a858ddcaf52c83d938c5ae61026c598d91ded7f32666ce73c9d1e jackson-databind-2.21.4-1.el9_8.src.rpm SHA-256: 222d54a87bdb0a8e9d6dd9aaf293f07d1f2002aa00578dd2b2287e1df0a515e7 jackson-jaxrs-providers-2.21.4-1.el9_8.src.rpm SHA-256: 6232e5269255069a372d174436cc5ea3ba3808d21f2e70656cf92f03c26a4959 jackson-modules-base-2.21.4-1.el9_8.src.rpm SHA-256: a15e246fd2cf4fec584f1517dfe2c8174bf7c467a5586fc198e9e0ed6930a304 s390x pki-jackson-annotations-2.21-1.el9_8.noarch.rpm SHA-256: dfdfecf5b10210cd3f4c24744a9edd6b97b1dab7b668d560ed43010d8a147041 pki-jackson-core-2.21.4-1.el9_8.noarch.rpm SHA-256: f12c4f028de61a609ce2a9a8594f0f825f284d7f72a823f824ac6c6bf765c1ba pki-jackson-databind-2.21.4-1.el9_8.noarch.rpm SHA-256: a4d6d467aad206c952b631b4515b40249eed0555b888fb895cf385be65976cb5 pki-jackson-jaxrs-json-provider-2.21.4-1.el9_8.noarch.rpm SHA-256: 4ad512b26f7788e02f968b4d2025f61e711a2077ca655202155f4de12dcbda46 pki-jackson-jaxrs-providers-2.21.4-1.el9_8.noarch.rpm SHA-256: 678bc5750f75a3311eb14e85f2700645ed9447a6cbfbebf44fdd82fae31586e6 pki-jackson-module-jaxb-annotations-2.21.4-1.el9_8.noarch.rpm SHA-256: 8fc1cd4877bc7c83e382de9f9d971fc0a59bae0d816d4741925ef5db6c18aaeb Red Hat Enterprise Linux for Power, little endian 9 SRPM jackson-annotations-2.21-1.el9_8.src.rpm SHA-256: 829c52041e5008b8b3c090c1000c13ea46ea9e0152e23c12340c15c9c1dc352a jackson-core-2.21.4-1.el9_8.src.rpm SHA-256: 76bf003fac2a858ddcaf52c83d938c5ae61026c598d91ded7f32666ce73c9d1e jackson-databind-2.21.4-1.el9_8.src.rpm SHA-256: 222d54a87bdb0a8e9d6dd9aaf293f07d1f2002aa00578dd2b2287e1df0a515e7 jackson-jaxrs-providers-2.21.4-1.el9_8.src.rpm SHA-256: 6232e5269255069a372d174436cc5ea3ba3808d21f2e70656cf92f03c26a4959 jackson-modules-base-2.21.4-1.el9_8.src.rpm SHA-256: a15e246fd2cf4fec584f1517dfe2c8174bf7c467a5586fc198e9e0ed6930a304 ppc64le pki-jackson-annotations-2.21-1.el9_8.noarch.rpm SHA-256: dfdfecf5b10210cd3f4c24744a9edd6b97b1dab7b668d560ed43010d8a147041 pki-jackson-core-2.21.4-1.el9_8.noarch.rpm SHA-256: f12c4f028de61a609ce2a9a8594f0f825f284d7f72a823f824ac6c6bf765c1ba pki-jackson-databind-2.21.4-1.el9_8.noarch.rpm SHA-256: a4d6d467aad206c952b631b4515b40249eed0555b888fb895cf385be65976cb5 pki-jackson-jaxrs-json-provider-2.21.4-1.el9_8.noarch.rpm SHA-256: 4ad512b26f7788e02f968b4d2025f61e711a2077ca655202155f4de12dcbda46 pki-jackson-jaxrs-providers-2.21.4-1.el9_8.noarch.r