VDB

RHSA-2026:77648

RHSA-2026:77648 PUBLISHED CVSS 7.5 HIGH

A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service (DoS) by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` fields from JSON strings, where the system processes arbitrarily long numeric components. This can lead to high CPU utilization, potentially saturating server worker threads and making the service unavailable.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatpython3-idm-pki-0:11.9.0-6.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-server-0:11.9.0-6.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatdogtag-pki-debugsource-0:11.9.0-6.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-tools-debuginfo-0:11.9.0-6.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-ca-0:11.9.0-6.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatdogtag-pki-0:11.9.0-6.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-tools-debuginfo-0:11.9.0-6.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-tools-0:11.9.0-6.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatdogtag-pki-debugsource-0:11.9.0-6.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-tools-0:11.9.0-6.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-acme-0:11.9.0-6.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-base-0:11.9.0-6.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-tools-0:11.9.0-6.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatdogtag-pki-debugsource-0:11.9.0-6.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatdogtag-pki-debugsource-0:11.9.0-6.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-tools-debuginfo-0:11.9.0-6.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-tools-debuginfo-0:11.9.0-6.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-java-0:11.9.0-6.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-tools-0:11.9.0-6.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2
Red Hatidm-pki-kra-0:11.9.0-6.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)0:11.9.0-6.el10_2

Timeline

  • Oct 8, 2026 CVE Published
  • Oct 21, 2026 CVE Updated
  • Oct 21, 2026 Distribution Patch
  • Oct 21, 2026 Distribution Patch
  • Oct 21, 2026 Security Advisory
  • Oct 21, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›