RHLW-2026-bad5ca0773255e9e
- Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-bad5ca0773255e9e.json
- Import Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-bad5ca0773255e9e.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/RHLW-2026-bad5ca0773255e9e
- Upstream
- Published
- 2026-10-08T19:45:03Z
- Modified
- 2026-10-20T23:13:15Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Lightwell Security Advisory: jackson-databind 2.13.4.1-rhlw-00013
- Details
-
Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.13.4.1-rhlw-00013 with backported fixes for CVE-2026-50193, CVE-2026-54512, CVE-2026-54513, and CVE-2026-54514.
CVE-2026-50193: jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
CVE-2026-54512: jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.13.4.1 from Maven Central.
- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50193.json
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh
- https://nvd.nist.gov/vuln/detail/CVE-2026-50193
- https://github.com/FasterXML/jackson-databind/issues/3447
- https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c
- https://github.com/advisories/GHSA-3wrr-7qpf-2prh
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54512.json
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm
- https://nvd.nist.gov/vuln/detail/CVE-2026-54512
- https://github.com/FasterXML/jackson-databind/issues/5988
- https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5
- https://github.com/advisories/GHSA-j3rv-43j4-c7qm
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json
- https://access.redhat.com/errata/RHSA-2026:36839
- https://access.redhat.com/errata/RHSA-2026:40895
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:43218
- https://access.redhat.com/errata/RHSA-2026:43400
- https://access.redhat.com/errata/RHSA-2026:44061
- https://access.redhat.com/errata/RHSA-2026:44062
- https://access.redhat.com/errata/RHSA-2026:44063
- https://access.redhat.com/errata/RHSA-2026:44064
- https://access.redhat.com/errata/RHSA-2026:44065
- https://access.redhat.com/errata/RHSA-2026:44066
- https://access.redhat.com/errata/RHSA-2026:44271
- https://access.redhat.com/errata/RHSA-2026:48095
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:50846
- https://access.redhat.com/errata/RHSA-2026:50847
- https://access.redhat.com/errata/RHSA-2026:50848
- https://access.redhat.com/errata/RHSA-2026:50849
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:54622
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/errata/RHSA-2026:66545
- https://access.redhat.com/security/cve/CVE-2026-54513
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54513.json
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f
- https://nvd.nist.gov/vuln/detail/CVE-2026-54513
- https://github.com/FasterXML/jackson-databind/issues/5981
- https://github.com/FasterXML/jackson-databind/issues/5983
- https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5
- https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e
- https://github.com/FasterXML/jackson-databind/pull/5984
- https://github.com/advisories/GHSA-rmj7-2vxq-3g9f
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54514.json
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5
- https://nvd.nist.gov/vuln/detail/CVE-2026-54514
- https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4
- https://github.com/FasterXML/jackson-databind/pull/5951
- https://github.com/advisories/GHSA-hgj6-7826-r7m5
- Credits
-
-
- Red Hat Lightwell - REMEDIATION_DEVELOPER
-