VDB
RHSA-2026:54440
RHSA-2026:54440
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85_amd64 as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 | * |
| Red Hat | registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5281c5150f8c786098bbaf43d036ca89ed21cf2bf68f09236de82fda4740dd27_s390x as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 | * |
| Red Hat | registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:5e413617445a6f5b238d5b45dae157df63c974b5a0262bce8754cdd3296f86a3_arm64 as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 | * |
| Red Hat | registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9@sha256:a2dd47734aa704b52c3ff8c9101c8309ea5647abf5d0b6d5a4e38627270f3d61_ppc64le as a component of Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 | * |
Timeline
- Aug 12, 2026 CVE Published
- Aug 24, 2026 CVE Updated
- Aug 24, 2026 Distribution Patch
- Aug 24, 2026 Distribution Patch
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54440 advisory
- https://access.redhat.com/security/cve/CVE-2026-50193 advisory
- https://access.redhat.com/security/cve/CVE-2026-54512 advisory
- https://access.redhat.com/security/cve/CVE-2026-59888 advisory
- https://access.redhat.com/security/cve/CVE-2026-68494 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54440.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2491999 issue
- https://www.cve.org/CVERecord?id=CVE-2026-50193 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-50193 advisory
- https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c advisory
- https://github.com/FasterXML/jackson-databind/issues/3447 advisory
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2492015 issue
- https://www.cve.org/CVERecord?id=CVE-2026-54512 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-54512 advisory
- https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5 advisory
- https://github.com/FasterXML/jackson-databind/issues/5988 advisory
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2500096 issue
…and 16 more