SUSE Jackson Important Update Security Vulnerabilities 2026-2801

Back Linuxsecurity

SUSE Jackson Important Update Security Vulnerabilities 2026-2801

Linuxsecurity •LinuxSecurity Advisories • July 9, 2026

Share: View original

## This update for jackson-annotations, jackson-bom, jackson-core, jackson- databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes the following issues * CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation (bsc#1268897). * CVE-2026-54513: jackson-databind: array subtype allowlist bypass in BasicPolymorphicTypeValidator (bsc#1268898). * CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899). * CVE-2026-54515: jackson-databindi: case-insensitive deserialization bypasses per-property @JsonIgnoreProperties (bsc#1268902). * jackson-core: document length constraint bypass in blocking, async, and

## This update for jackson-annotations, jackson-bom, jackson-core, jackson- databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes the following issues * CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation (bsc#1268897). * CVE-2026-54513: jackson-databind: array subtype allowlist bypass in BasicPolymorphicTypeValidator (bsc#1268898). * CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899). * CVE-2026-54515: jackson-databindi: case-insensitive deserialization bypasses per-property @JsonIgnoreProperties (bsc#1268902). * jackson-core: document length constraint bypass in blocking, async, and

* CVE-2026-54512 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-54512 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-54513 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-54513 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-54513 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-54514 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

* CVE-2026-54514 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

* CVE-2026-54515 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Announcement ID: SUSE-SU-2026:2801-1 Release Date: 2026-07-08T19:05:27Z Rating: important

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SUSE Jackson Annotations Security Vulnerabilities Addressed in Recent Updates SUSE released important security updates for jackson-annotations, jackson-core, and jackson-databind to address multiple vulnerabilities identified as CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, and CVE-2026-54515. These vulnerabilities include a PolymorphicTypeValidator bypass, array subtype allowlist bypass, and issues related to eager DNS resolution and case-insensitive deserialization. The vulnerabilities were published on June 23, 2026, and have been rated with CVSS scores ranging from 5.3 to 8.1, indicating a significant risk. The updates were released on July 1, 2026, and July 8, 2026, respectively. Users of affected systems are advised to apply the updates promptly to mitigate potential exploitation. The vulnerabilities could allow attackers to instantiate arbitrary classes or bypass security features, leading to unauthorized access or data exposure. 2 sources 65

Extracted Entities

CVEs (4)

CVE-2026-54512 CVE-2026-54513 CVE-2026-54514 CVE-2026-54515

CWE Weaknesses (1)

Cwe-502 - Deserialization Of Untrusted Data