VDB
RHSA-2026:86621
RHSA-2026:86621
PUBLISHED
CVSS 8.100000381469727 HIGH
Record from redhat · Published October 21, 2026
A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service (DoS) by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` fields from JSON strings, where the system processes arbitrarily long numeric components. This can lead to high CPU utilization, potentially saturating server worker threads and making the service unavailable.
Risk scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | dogtag-pki-0:11.6.0-3.el10_0.1.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | python3-idm-pki-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-java-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | dogtag-pki-debugsource-0:11.6.0-3.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-tools-0:11.6.0-3.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-server-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-acme-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-tools-debuginfo-0:11.6.0-3.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-tools-debuginfo-0:11.6.0-3.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-base-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-ca-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-tools-debuginfo-0:11.6.0-3.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-tools-0:11.6.0-3.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-tools-0:11.6.0-3.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-tools-0:11.6.0-3.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | dogtag-pki-debugsource-0:11.6.0-3.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-tools-debuginfo-0:11.6.0-3.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | dogtag-pki-debugsource-0:11.6.0-3.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | dogtag-pki-debugsource-0:11.6.0-3.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
| Red Hat | idm-pki-kra-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:11.6.0-3.el10_0.1 |
Timeline
- Oct 21, 2026 CVE Published
- Nov 4, 2026 CVE Updated
- Nov 4, 2026 Distribution Patch (2 in total, the first dated here)
- Nov 4, 2026 Security Advisory (4 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln RHSA-2026:86621
vulnetix vdb fixes RHSA-2026:86621Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%3A86621/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://access.redhat.com/errata/RHSA-2026:86621 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2519523 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2523749 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2531964 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86621.json advisory
- https://access.redhat.com/security/cve/CVE-2026-68497 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-68497 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-68497 advisory
- https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd advisory
- https://github.com/FasterXML/jackson-databind/pull/6127 advisory
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7 advisory
- https://access.redhat.com/security/cve/CVE-2026-76561 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-76561 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-76561 advisory
- https://access.redhat.com/security/cve/CVE-2026-80110 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-80110 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-80110 advisory