VDB

RHSA-2026:86621

RHSA-2026:86621 PUBLISHED CVSS 8.100000381469727 HIGH

A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service (DoS) by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` fields from JSON strings, where the system processes arbitrarily long numeric components. This can lead to high CPU utilization, potentially saturating server worker threads and making the service unavailable.

Risk Scores

CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected Products

VendorProductVersions
Red Hatdogtag-pki-0:11.6.0-3.el10_0.1.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatpython3-idm-pki-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-java-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatdogtag-pki-debugsource-0:11.6.0-3.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-tools-0:11.6.0-3.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-server-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-acme-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-tools-debuginfo-0:11.6.0-3.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-tools-debuginfo-0:11.6.0-3.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-base-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-ca-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-tools-debuginfo-0:11.6.0-3.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-tools-0:11.6.0-3.el10_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-tools-0:11.6.0-3.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-tools-0:11.6.0-3.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatdogtag-pki-debugsource-0:11.6.0-3.el10_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-tools-debuginfo-0:11.6.0-3.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatdogtag-pki-debugsource-0:11.6.0-3.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatdogtag-pki-debugsource-0:11.6.0-3.el10_0.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1
Red Hatidm-pki-kra-0:11.6.0-3.el10_0.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)0:11.6.0-3.el10_0.1

Timeline

  • Oct 21, 2026 CVE Published
  • Oct 21, 2026 CVE Updated
  • Oct 21, 2026 Distribution Patch
  • Oct 21, 2026 Distribution Patch
  • Oct 21, 2026 Security Advisory
  • Oct 21, 2026 Security Advisory
  • Oct 21, 2026 Security Advisory
  • Oct 21, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›