CLEANSTART-2026-DU82545

See a problem?
Import Source
https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-DU82545.json
JSON Data
https://api.test.osv.dev/v1/vulns/CLEANSTART-2026-DU82545
Upstream
Published
2026-11-11T00:38:51Z
Modified
2026-11-11T01:00:41Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be ...
Details

CVE-2026-110879 affects multiple packages. jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. See references for individual vulnerability details.

References

Affected packages

CleanStart
kafka

Package

Name
kafka
Purl
pkg:apk/cleanstart/kafka

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.3.2-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-DU82545.json"
kafka

Package

Name
kafka
Purl
pkg:apk/cleanstart/kafka

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.0.2-r6

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-DU82545.json"
kafka

Package

Name
kafka
Purl
pkg:apk/cleanstart/kafka

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.4.0-r1

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-DU82545.json"
solr

Package

Name
solr
Purl
pkg:apk/cleanstart/solr

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
10.0.0-r12

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-DU82545.json"
apache-nifi

Package

Name
apache-nifi
Purl
pkg:apk/cleanstart/apache-nifi

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.11.0-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-DU82545.json"
rundeck

Package

Name
rundeck
Purl
pkg:apk/cleanstart/rundeck

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.1.0-r5

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-DU82545.json"
keycloak

Package

Name
keycloak
Purl
pkg:apk/cleanstart/keycloak

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
26.6.4-r8

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-DU82545.json"