RLSA-2026:40895

Synopsis

Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

Description

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.

Security Fix(es):

* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)

* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Rocky Linux 9 aarch64 Rocky Linux 9 ppc64le Rocky Linux 9 s390x Rocky Linux 9 x86_64

Fixes

2492010 2492015

CVEs

CVE-2026-54512 CVE-2026-54513

Affected packages

Rocky Linux 9 x86_64 - AppStream

jackson-annotations-0:2.21-1.el9_8.src.rpm jackson-core-0:2.21.4-1.el9_8.src.rpm jackson-databind-0:2.21.4-1.el9_8.src.rpm jackson-jaxrs-providers-0:2.21.4-1.el9_8.src.rpm jackson-modules-base-0:2.21.4-1.el9_8.src.rpm pki-jackson-annotations-0:2.21-1.el9_8.noarch.rpm pki-jackson-core-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-databind-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch.rpm

Rocky Linux 9 aarch64 - AppStream

jackson-annotations-0:2.21-1.el9_8.src.rpm jackson-core-0:2.21.4-1.el9_8.src.rpm jackson-databind-0:2.21.4-1.el9_8.src.rpm jackson-jaxrs-providers-0:2.21.4-1.el9_8.src.rpm jackson-modules-base-0:2.21.4-1.el9_8.src.rpm pki-jackson-annotations-0:2.21-1.el9_8.noarch.rpm pki-jackson-core-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-databind-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch.rpm

Rocky Linux 9 s390x - AppStream

jackson-annotations-0:2.21-1.el9_8.src.rpm jackson-core-0:2.21.4-1.el9_8.src.rpm jackson-databind-0:2.21.4-1.el9_8.src.rpm jackson-jaxrs-providers-0:2.21.4-1.el9_8.src.rpm jackson-modules-base-0:2.21.4-1.el9_8.src.rpm pki-jackson-annotations-0:2.21-1.el9_8.noarch.rpm pki-jackson-core-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-databind-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch.rpm

Rocky Linux 9 ppc64le - AppStream

jackson-annotations-0:2.21-1.el9_8.src.rpm jackson-core-0:2.21.4-1.el9_8.src.rpm jackson-databind-0:2.21.4-1.el9_8.src.rpm jackson-jaxrs-providers-0:2.21.4-1.el9_8.src.rpm jackson-modules-base-0:2.21.4-1.el9_8.src.rpm pki-jackson-annotations-0:2.21-1.el9_8.noarch.rpm pki-jackson-core-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-databind-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-jaxrs-json-provider-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-jaxrs-providers-0:2.21.4-1.el9_8.noarch.rpm pki-jackson-module-jaxb-annotations-0:2.21.4-1.el9_8.noarch.rpm